Task: attack_reconstruction (flaws_cloudtrail)
Prompt: Review the CloudTrail records for a session-credentialed principal that moves from storage discovery into object access against an S3 bucket. Identify the responsible principal, the applicable MITRE ATT&CK technique, the supporting CloudTrail record_ids for each phase of the chain you reconstruct, and the impacted AWS assets. Return a JSON object matching the AttackReconstructionAnswer schema. Use principal.arn for primary_actor, the MITRE ATT&CK ID (e.g. T1530) for technique, and group the supporting CloudTrail record_ids by attack phase. List the AWS asset identifiers (bucket names, role/user names, trail names, ARNs) the attack acted on as impacted_assets.
Answer schema: attack_reconstruction_answer

CloudTrail records:
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7a4e4ec5-ff9f-45c1-9f94-cf6983cbd019", "record_id": "flaws_cloudtrail:0000000:7a4e4ec5-ff9f-45c1-9f94-cf6983cbd019", "row_index": 0, "timestamp": "2018-04-17T21:27:55Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7a4e4ec5-ff9f-45c1-9f94-cf6983cbd019", "eventTime": "2018-04-17T21:27:55Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7beca8ae-ce1b-47b2-845c-aa8198336245", "record_id": "flaws_cloudtrail:0000001:7beca8ae-ce1b-47b2-845c-aa8198336245", "row_index": 1, "timestamp": "2018-04-17T21:27:55Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7beca8ae-ce1b-47b2-845c-aa8198336245", "eventTime": "2018-04-17T21:27:55Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e81a45e3-00fe-452c-89a6-5446e8bc174f", "record_id": "flaws_cloudtrail:0000002:e81a45e3-00fe-452c-89a6-5446e8bc174f", "row_index": 2, "timestamp": "2018-04-17T21:27:55Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e81a45e3-00fe-452c-89a6-5446e8bc174f", "eventTime": "2018-04-17T21:27:55Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f8cd29bd-618a-4cad-a130-e576853a49185", "record_id": "flaws_cloudtrail:0000003:f8cd29bd-618a-4cad-a130-e576853a49185", "row_index": 3, "timestamp": "2018-04-17T21:27:55Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f8cd29bd-618a-4cad-a130-e576853a49185", "eventTime": "2018-04-17T21:27:55Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "af50b61a-4e10-4ab7-86c8-423d7ad968db", "record_id": "flaws_cloudtrail:0000004:af50b61a-4e10-4ab7-86c8-423d7ad968db", "row_index": 4, "timestamp": "2018-04-17T21:27:55Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "af50b61a-4e10-4ab7-86c8-423d7ad968db", "eventTime": "2018-04-17T21:27:55Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b6d548b3-69c4-408d-9096-0284aa1a1736", "record_id": "flaws_cloudtrail:0000005:b6d548b3-69c4-408d-9096-0284aa1a1736", "row_index": 5, "timestamp": "2018-04-17T21:27:55Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b6d548b3-69c4-408d-9096-0284aa1a1736", "eventTime": "2018-04-17T21:27:55Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bb3769c0-07e8-4491-8d52-87f0d74a55a3", "record_id": "flaws_cloudtrail:0000006:bb3769c0-07e8-4491-8d52-87f0d74a55a3", "row_index": 6, "timestamp": "2018-04-17T21:27:56Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bb3769c0-07e8-4491-8d52-87f0d74a55a3", "eventTime": "2018-04-17T21:27:56Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4bc12f77-4a6f-4c3f-9dfd-a242d46d1444", "record_id": "flaws_cloudtrail:0000007:4bc12f77-4a6f-4c3f-9dfd-a242d46d1444", "row_index": 7, "timestamp": "2018-04-17T21:27:56Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4bc12f77-4a6f-4c3f-9dfd-a242d46d1444", "eventTime": "2018-04-17T21:27:56Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "609cf91f-a201-4dfe-88ad-67d946530c48", "record_id": "flaws_cloudtrail:0000008:609cf91f-a201-4dfe-88ad-67d946530c48", "row_index": 8, "timestamp": "2018-04-17T21:27:56Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "609cf91f-a201-4dfe-88ad-67d946530c48", "eventTime": "2018-04-17T21:27:56Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1bb1989e-6347-4086-a8f7-6f615318b7", "record_id": "flaws_cloudtrail:0000009:1bb1989e-6347-4086-a8f7-6f615318b7", "row_index": 9, "timestamp": "2018-04-17T21:27:56Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1bb1989e-6347-4086-a8f7-6f615318b7", "eventTime": "2018-04-17T21:27:56Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6f3cac45-b1ad-439c-8c1e-43b45bcd4887", "record_id": "flaws_cloudtrail:0000010:6f3cac45-b1ad-439c-8c1e-43b45bcd4887", "row_index": 10, "timestamp": "2018-04-17T21:27:56Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6f3cac45-b1ad-439c-8c1e-43b45bcd4887", "eventTime": "2018-04-17T21:27:56Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ba796b66-ccd5-4ece-8f98-d40e2db4a72b", "record_id": "flaws_cloudtrail:0000011:ba796b66-ccd5-4ece-8f98-d40e2db4a72b", "row_index": 11, "timestamp": "2018-04-17T21:27:57Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ba796b66-ccd5-4ece-8f98-d40e2db4a72b", "eventTime": "2018-04-17T21:27:57Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7f568ce4-8d7e-4d0e-b7d3-7a23348ce3f", "record_id": "flaws_cloudtrail:0000012:7f568ce4-8d7e-4d0e-b7d3-7a23348ce3f", "row_index": 12, "timestamp": "2018-04-17T21:27:57Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1281, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7f568ce4-8d7e-4d0e-b7d3-7a23348ce3f", "eventTime": "2018-04-17T21:27:57Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a27feb3f-526d-4948-bbe9-cd58db1f0a4b", "record_id": "flaws_cloudtrail:0000013:a27feb3f-526d-4948-bbe9-cd58db1f0a4b", "row_index": 13, "timestamp": "2018-04-17T21:27:57Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1176, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a27feb3f-526d-4948-bbe9-cd58db1f0a4b", "eventTime": "2018-04-17T21:27:57Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "55787df6-0245-465e-948c-0afe9b69055c", "record_id": "flaws_cloudtrail:0000014:55787df6-0245-465e-948c-0afe9b69055c", "row_index": 14, "timestamp": "2018-04-17T21:27:57Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "55787df6-0245-465e-948c-0afe9b69055c", "eventTime": "2018-04-17T21:27:57Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "87ff4e9c-307c-4709-83dd-8ae485c96555", "record_id": "flaws_cloudtrail:0000015:87ff4e9c-307c-4709-83dd-8ae485c96555", "row_index": 15, "timestamp": "2018-04-17T21:27:57Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "87ff4e9c-307c-4709-83dd-8ae485c96555", "eventTime": "2018-04-17T21:27:57Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fec4f372-5b92-4476-8298-d2ee085db7ed", "record_id": "flaws_cloudtrail:0000016:fec4f372-5b92-4476-8298-d2ee085db7ed", "row_index": 16, "timestamp": "2018-04-17T21:27:57Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1170, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fec4f372-5b92-4476-8298-d2ee085db7ed", "eventTime": "2018-04-17T21:27:57Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d311859c2-6651-4ddf-bb2a-167560613963", "record_id": "flaws_cloudtrail:0000017:d311859c2-6651-4ddf-bb2a-167560613963", "row_index": 17, "timestamp": "2018-04-17T21:27:58Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1284, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d311859c2-6651-4ddf-bb2a-167560613963", "eventTime": "2018-04-17T21:27:58Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e971717c-d7de-40ce-9177-57775c4b64", "record_id": "flaws_cloudtrail:0000018:e971717c-d7de-40ce-9177-57775c4b64", "row_index": 18, "timestamp": "2018-04-17T21:27:58Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1834, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e971717c-d7de-40ce-9177-57775c4b64", "eventTime": "2018-04-17T21:27:58Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 9EyBDxEMlVly_f-1YTNpCq_cCQ5JCf-Ip7HiAt2fpn3nD7UiN2fLaM-RwvnxrsFX2TXYtmkOcQ1ikh2rFDSNI_dkv6WmudZFg3tf3XGTplxGPNtzuak6skYGksQUK5AIN9yzBWT_usqUofcADolokeOse9tmPquxwHJYkgM2ir5AQlQWDMVtU-DBgkXhKByB4nvPcU8vylxWNEFgW2708cZNu8NS-46jSFF0F6b5LINKAKMyKnlff0J8eNSyRyzDOz8sroY8pPt-WZOzu8yYhyBWYmLxyIXwHjm4CkzIxIqPQZx9NJ9auq_F_xh7OUklGfn9nuJu9NDtLIBCyPYIjCfO6Drhc5P6MxzBYiod6k3l8clg7QITtMvrKxPi2qxpJn1V1Sp87UMrNonM3__USPHmmS3QKrtCD9SwVAc0gTTmAbl5wK7azAV8tIXtKFQpUuSYbvGn6bKVF2D6XmiTfTgInR5Wg5f-T0oZt-1pzBHms5JXI1ZA_mAtJ_p6zzWtBLKfhc8MxN-ZsxBVrHjHmg1U5s9qa_aUQ_jHmLpAnjMORYxjf8Y_lU9kGLO0d8rxPi9sc3LYFsfWoIPeli2dtnFxH9CBw2oibsY6DhxfAEtMWwQHy22CdivvUQ1bzgKCcRcKPYx3-adCJZ-9ZPnRQRX_zvekiyrdw6KxHwj3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d3b55038-5721-42e0-9072-8189aea33c17", "record_id": "flaws_cloudtrail:0000019:d3b55038-5721-42e0-9072-8189aea33c17", "row_index": 19, "timestamp": "2018-04-17T21:27:58Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d3b55038-5721-42e0-9072-8189aea33c17", "eventTime": "2018-04-17T21:27:58Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a6b227647-81d5-45ca-9a84-19b9d1673a57", "record_id": "flaws_cloudtrail:0000020:a6b227647-81d5-45ca-9a84-19b9d1673a57", "row_index": 20, "timestamp": "2018-04-17T21:27:59Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1839, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a6b227647-81d5-45ca-9a84-19b9d1673a57", "eventTime": "2018-04-17T21:27:59Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 01jVh2JQyV4jRtWG3ind4S4UlYtqAimPyQus_ho95uYUxSJYb7416QPUeGP28Pj5UE2AT5RD848Xow4-ZONyzgZpQpHZuwDPbQVslH5MbAdpYf-64vyu1WPL_kfHrjP2rDbVPJu4AwNCAeiwJk71osBvyXdtYjHYGF6QOjx4y2Iyoj-lCiTi5Z9gtckGC70Th5QfTdy2mDNig9SF9pMX4Y-NehUmoTkUKzmLTGCx4K7kvy-JWz56B1es78yspsVFp9yXYd0SttT8SaE6o1g5OYqSGWYzB_iRizbyoscfpB77lflAoRnxXB_pSUT1HHRFv7jpIJmJRuhktPaolXaSmN0JkZsTc7f44XuO26HRmwgORUaNb4UdFFja9ujKVcQULWClAHwKD2DdsHv_OwceTE7vh_UI736tGi7EZZ_SFx-bPAE0-zaJlmHqWWjhDTt74WrpwpX6KEAZ7ROnLV7in5aaAnjceArjK9LBZ0SIBqAQpcaNYK6KQmtWmu1kYkETEEfrWlN451Z1CQV8iOk84a98BggTxUFJji3rJStS_7eYpkk8oE7gd9BBsA5PBhHEy1Y6vR1JXycMWAMikYmmiIP79W1EJls0A0s0WR-48dlr59NbucCZo65xJfk3WeqwK_hPOCI2Td7GxF988qbTmOznoLethdIPMeuUImU3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "30b2be96-642e-4f28-b1c2-2d32a738969", "record_id": "flaws_cloudtrail:0000021:30b2be96-642e-4f28-b1c2-2d32a738969", "row_index": 21, "timestamp": "2018-04-17T21:27:59Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 814, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "30b2be96-642e-4f28-b1c2-2d32a738969", "eventTime": "2018-04-17T21:27:59Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ec486d5c-69ec-4aed-9bd2-71fec5822b2d", "record_id": "flaws_cloudtrail:0000022:ec486d5c-69ec-4aed-9bd2-71fec5822b2d", "row_index": 22, "timestamp": "2018-04-17T21:27:59Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ec486d5c-69ec-4aed-9bd2-71fec5822b2d", "eventTime": "2018-04-17T21:27:59Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3bb9640a-3d93-4fda-a7e2-de25629fd8ca", "record_id": "flaws_cloudtrail:0000023:3bb9640a-3d93-4fda-a7e2-de25629fd8ca", "row_index": 23, "timestamp": "2018-04-17T21:27:59Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1276, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3bb9640a-3d93-4fda-a7e2-de25629fd8ca", "eventTime": "2018-04-17T21:27:59Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "764b0d58-210c-4044-a487-fb689a90067", "record_id": "flaws_cloudtrail:0000024:764b0d58-210c-4044-a487-fb689a90067", "row_index": 24, "timestamp": "2018-04-17T21:27:59Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1170, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "764b0d58-210c-4044-a487-fb689a90067", "eventTime": "2018-04-17T21:27:59Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d2627c22-dd94-4a70-9176-5f11fb14eabe", "record_id": "flaws_cloudtrail:0000025:d2627c22-dd94-4a70-9176-5f11fb14eabe", "row_index": 25, "timestamp": "2018-04-17T21:28:00Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 812, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d2627c22-dd94-4a70-9176-5f11fb14eabe", "eventTime": "2018-04-17T21:28:00Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f5a56424-08b6-468b-9d4d-85d7be271def", "record_id": "flaws_cloudtrail:0000026:f5a56424-08b6-468b-9d4d-85d7be271def", "row_index": 26, "timestamp": "2018-04-17T21:28:00Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f5a56424-08b6-468b-9d4d-85d7be271def", "eventTime": "2018-04-17T21:28:00Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "af1e2d91-5448-4978-ad73-5ea56f6f1c2a", "record_id": "flaws_cloudtrail:0000027:af1e2d91-5448-4978-ad73-5ea56f6f1c2a", "row_index": 27, "timestamp": "2018-04-17T21:28:00Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1828, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "af1e2d91-5448-4978-ad73-5ea56f6f1c2a", "eventTime": "2018-04-17T21:28:00Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: R2yEVwG4JbN5XB9jezkaaptSjUtfYzZJcG6I25l9YxJhxKpUDDS7zyE7kgw3UC7oC4rfah_2dWe-CXqzjWfeCah_jiWxpjWq9AKM2SRGSS3bHKwewvwihBNLwOHPW3yqICFyCxScYsWNO90CWP5NyviiBtRSqFOleeDLAm3frueJ7n832dYJzvitg_GEPvFnfr2qmUd7jO9wWvPFVDVdFt5k0-Onr0l7hfZbBP2t5E54v5zZJyijeoYIhtOUq87RLq_2cocQd07CN1WSa6KvYUoQ0S6C9bSKL8ePXHIZ9aUUb9kXjuLIPMJMqp9lja8JJZo5YESTN1SwPKvO7at9g0pIk451hUBbo04rMSqj2JzX2GRJ2ztcjKxsjZ5VD7HnPTRqmg0-8urdVNo60Rj5FAhIsJf6nM2UZ6gTQVRtysWVvvAYc9wb1ZcnM2Z2BhPNnnUwNiEfhw_fYD1upvItbayiPcokAmDY_hCSZxZ3fGbz2O9Ci4tYTEq4uVYs8vGTa-nLvc3-szlwB937fQzBN1QUjyE1LQTbrUpIhAckqxdAQfq0kSnHBEQlXuK3vAWcrzpvZQJ3EZnItA7Ao_R1bxLR4PO_tzmKPIg1lSLyNtOCOkdBvMR3KQ-xY-ZaxTsLb48C5jOrS-oO4o98dMEsDoIYdBNzcaOFme4", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3a1dc779-65a6-409b-8445-d69cbf680a94", "record_id": "flaws_cloudtrail:0000028:3a1dc779-65a6-409b-8445-d69cbf680a94", "row_index": 28, "timestamp": "2018-04-17T21:28:01Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 815, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3a1dc779-65a6-409b-8445-d69cbf680a94", "eventTime": "2018-04-17T21:28:01Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "87c949222-34c8-4764-9d32-641b13b5664c", "record_id": "flaws_cloudtrail:0000029:87c949222-34c8-4764-9d32-641b13b5664c", "row_index": 29, "timestamp": "2018-04-17T21:28:01Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "87c949222-34c8-4764-9d32-641b13b5664c", "eventTime": "2018-04-17T21:28:01Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c97a19d4-bc84-4be0-babe-14594d09bcc2", "record_id": "flaws_cloudtrail:0000030:c97a19d4-bc84-4be0-babe-14594d09bcc2", "row_index": 30, "timestamp": "2018-04-17T21:28:01Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c97a19d4-bc84-4be0-babe-14594d09bcc2", "eventTime": "2018-04-17T21:28:01Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "491a68c3-60f8-4368-8966-dc749fe9333d", "record_id": "flaws_cloudtrail:0000031:491a68c3-60f8-4368-8966-dc749fe9333d", "row_index": 31, "timestamp": "2018-04-17T21:28:02Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "491a68c3-60f8-4368-8966-dc749fe9333d", "eventTime": "2018-04-17T21:28:02Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "531d3ad6-b488-4770-b857-a26cd209873", "record_id": "flaws_cloudtrail:0000032:531d3ad6-b488-4770-b857-a26cd209873", "row_index": 32, "timestamp": "2018-04-17T21:28:03Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "531d3ad6-b488-4770-b857-a26cd209873", "eventTime": "2018-04-17T21:28:03Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7667bed3-5fa2-40f2-9308-ac586c43eda8", "record_id": "flaws_cloudtrail:0000033:7667bed3-5fa2-40f2-9308-ac586c43eda8", "row_index": 33, "timestamp": "2018-04-17T21:28:03Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7667bed3-5fa2-40f2-9308-ac586c43eda8", "eventTime": "2018-04-17T21:28:03Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5d9a4f46-0933-4dd2-a27a-82159dab2724", "record_id": "flaws_cloudtrail:0000034:5d9a4f46-0933-4dd2-a27a-82159dab2724", "row_index": 34, "timestamp": "2018-04-17T21:28:03Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1275, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5d9a4f46-0933-4dd2-a27a-82159dab2724", "eventTime": "2018-04-17T21:28:03Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f5752fbf-13f8-4222-b106-7761d99560cc", "record_id": "flaws_cloudtrail:0000035:f5752fbf-13f8-4222-b106-7761d99560cc", "row_index": 35, "timestamp": "2018-04-17T21:28:03Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1827, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f5752fbf-13f8-4222-b106-7761d99560cc", "eventTime": "2018-04-17T21:28:03Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: lfY35CB_wPQfgSIh6sMth73bq4udfnwbT87CLDm3alG2_VjR6KIwJPV35LRsIwEb1aA9OOWW8a2WUCEpOGCXg9E12AYJcNw8Pz3HAzyMy2XGBG6j26TWxmAzgGx4R2vw221PFGs1vHFECERV-ZkT7GbjX2ntxhU5CgerrBhmz-UxXSGjQ0HFPkY8lbW2xceO5p9hL1kE7AjsN0t-VMIFmkXDa59k1jbdiVWgB3DpU_5OWw2Yu6Fr_wU4HOmQgFE2NE_VcDL-RsQTS6pKc-j3umC5Ady5Gto4NaG_rMIT3jA2g1EuNFOLz0xv8CFLphg6jI-K3CveGKkZ12S6jEm6Yg9xeH1O20crgCm9IOFJ3CgUtmxbd6sqN6437r8nV6HvwhKy_orD6W-ZW279QhPLyx_AOl5b-XmCshqK0HDIyLzY9cjd0fSwmh3I9hIKCaMUGHNuXV59cATt5neIuQGWVt1WpE8oYWby6xce7_kyewwtNx97d4UR6_36mZIPGNryW1cEMg4xLso2IKXWH-E-z3biSx1JMSkRYDALJhiQeVcMjSEC_Y3aHKYRFrqjNLvn7w25nn1A-v0h1IgMKoYtq5jy5111k02ujmlVcBQh-R545A04k-2VZNtI2idXM_vaRUCT_UjzCVdwqJvfOjpCV55yE7yMONrJNA", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fb295278-3de7-4d0f-b8b2-5c7eb7e5d063", "record_id": "flaws_cloudtrail:0000036:fb295278-3de7-4d0f-b8b2-5c7eb7e5d063", "row_index": 36, "timestamp": "2018-04-17T21:28:04Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fb295278-3de7-4d0f-b8b2-5c7eb7e5d063", "eventTime": "2018-04-17T21:28:04Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b8b4d776-621e-4cd3-b7ed-94d6c6a130dd", "record_id": "flaws_cloudtrail:0000037:b8b4d776-621e-4cd3-b7ed-94d6c6a130dd", "row_index": 37, "timestamp": "2018-04-17T21:28:04Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b8b4d776-621e-4cd3-b7ed-94d6c6a130dd", "eventTime": "2018-04-17T21:28:04Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1105a9be-9914-496e-918b-f183e97e9c43", "record_id": "flaws_cloudtrail:0000038:1105a9be-9914-496e-918b-f183e97e9c43", "row_index": 38, "timestamp": "2018-04-17T21:28:04Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1105a9be-9914-496e-918b-f183e97e9c43", "eventTime": "2018-04-17T21:28:04Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6fc87b4e-e982-4ceb-bf69-eaf5deac5661", "record_id": "flaws_cloudtrail:0000039:6fc87b4e-e982-4ceb-bf69-eaf5deac5661", "row_index": 39, "timestamp": "2018-04-17T21:28:04Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1171, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6fc87b4e-e982-4ceb-bf69-eaf5deac5661", "eventTime": "2018-04-17T21:28:04Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "41fb02f0-7d67-4fc4-b860-b4b7dc48bec5", "record_id": "flaws_cloudtrail:0000040:41fb02f0-7d67-4fc4-b860-b4b7dc48bec5", "row_index": 40, "timestamp": "2018-04-17T21:28:04Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "41fb02f0-7d67-4fc4-b860-b4b7dc48bec5", "eventTime": "2018-04-17T21:28:04Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8edc9649-4b02-4ea4-96bc-0b9b8a663566", "record_id": "flaws_cloudtrail:0000041:8edc9649-4b02-4ea4-96bc-0b9b8a663566", "row_index": 41, "timestamp": "2018-04-17T21:28:05Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8edc9649-4b02-4ea4-96bc-0b9b8a663566", "eventTime": "2018-04-17T21:28:05Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c9f54d01-506c-4b11-a315-954c03675b6a", "record_id": "flaws_cloudtrail:0000042:c9f54d01-506c-4b11-a315-954c03675b6a", "row_index": 42, "timestamp": "2018-04-17T21:28:05Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c9f54d01-506c-4b11-a315-954c03675b6a", "eventTime": "2018-04-17T21:28:05Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e089906-86cf-462c-859f-3140bd2b1ac7", "record_id": "flaws_cloudtrail:0000043:e089906-86cf-462c-859f-3140bd2b1ac7", "row_index": 43, "timestamp": "2018-04-17T21:28:05Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e089906-86cf-462c-859f-3140bd2b1ac7", "eventTime": "2018-04-17T21:28:05Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9021d776-5a92-4192-b322-417990b6b1", "record_id": "flaws_cloudtrail:0000044:9021d776-5a92-4192-b322-417990b6b1", "row_index": 44, "timestamp": "2018-04-17T21:28:05Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9021d776-5a92-4192-b322-417990b6b1", "eventTime": "2018-04-17T21:28:05Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "67861-15f7-4523-8f77-f5776ea2ae41", "record_id": "flaws_cloudtrail:0000045:67861-15f7-4523-8f77-f5776ea2ae41", "row_index": 45, "timestamp": "2018-04-17T21:28:06Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1173, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "67861-15f7-4523-8f77-f5776ea2ae41", "eventTime": "2018-04-17T21:28:06Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "921bfa2c-6793-4641-bb82-1e88a94fbb64", "record_id": "flaws_cloudtrail:0000046:921bfa2c-6793-4641-bb82-1e88a94fbb64", "row_index": 46, "timestamp": "2018-04-17T21:28:06Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "921bfa2c-6793-4641-bb82-1e88a94fbb64", "eventTime": "2018-04-17T21:28:06Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "63ec629c-d2c0-4838-b1f0-7b315c3e5c7c", "record_id": "flaws_cloudtrail:0000047:63ec629c-d2c0-4838-b1f0-7b315c3e5c7c", "row_index": 47, "timestamp": "2018-04-17T21:28:06Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1280, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "63ec629c-d2c0-4838-b1f0-7b315c3e5c7c", "eventTime": "2018-04-17T21:28:06Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61088cf-6cb3-4f4b-a27e-10200e4c3f6b", "record_id": "flaws_cloudtrail:0000048:61088cf-6cb3-4f4b-a27e-10200e4c3f6b", "row_index": 48, "timestamp": "2018-04-17T21:28:06Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1825, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61088cf-6cb3-4f4b-a27e-10200e4c3f6b", "eventTime": "2018-04-17T21:28:06Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: FOZUZufpw50fql6p2rh8KC8Z3hT-b9nIZbQOGGpknBfQoxIokypEtXRmz7lPm9cLgsQQEmdTMMsmAhL89gLwK9BOtAjAUGRx71A5iftvcwuCLknesAdPuoHTWmLqq_yGNHOXWPOBAL8LtG8JL2CxREBrWERrkpw1QxONymXRO_w6wnszFn6UX900A981h6dVYKswmcxI-m7ltpPKjwNc3nAmv0y-9qPkDBoYf00fu0McmV5oMEXLCPtAS9lacx-xi0l5KX_HSTkc_exI95shQPIguR5Ok_g6BtbKrDJnWfQMvDACdV3fLmiUkG6Z5O1Rrv1wUFIbTfqc9vUKH7dnTlt9ugVtmKlR4g3eV4Gr3xHsC0xXwGZhuP6RsJ2Bz9JE3cdQJbD8YCJGP8LATLVvGXkFJFZwjOKpJFsaCjA0EidLME_o6Oa3We-djBOu8Avg4Ne1JjjguDYZ_J7qs-D4zZiKRryX__ir2pnM9qF-gb4VJ6PL2pJ8k1QFHuxJImofAznpZd9E-VXWrWz02qysHAz2bZ4CA13j8YdhtsR_0k2iR5sazkY3KzilDATAw8oL3qEDaO6P_QMu8zs30iqJ1M0F2CBLi_FYsulw5FzjysGE4DqkSRaVHAPZXfwdNZhcO0tuchBzMqhmxeJrjdZs_Lo201xyfyyAKw", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "976574-19a0-4e0d-ae89-8bb3c6dc5ba1", "record_id": "flaws_cloudtrail:0000049:976574-19a0-4e0d-ae89-8bb3c6dc5ba1", "row_index": 49, "timestamp": "2018-04-17T21:28:07Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1832, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "976574-19a0-4e0d-ae89-8bb3c6dc5ba1", "eventTime": "2018-04-17T21:28:07Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 2THAOWJqjhCU4vC1d_fceTxrvRSTFhxDz3xtIwDjmU9HpnQSs-GWGB1pi5KSAlNghN-M-259lDEJeOSddWNWUf_eK8bH-cHIjkdRqK5iBPEA4c2Bm1eKFYUFvO7mX5uqujf_MiNYyqp_bjxQcaSQX5JR2GoSBEIS_DQxnYHjrBikKNRmUbuX4KwIyjNyJuCY46GgWnXMZceB3oziRaYaaiMnzTmjFOpt9_ROHt28jjIcVtrET1ec_I7_an0fn0C8eVI4D8DYZQHPII4E06lOo7ACOb7jFq1DWA5Zs7sf-bePhvbpQqhrFTXc4JCiDdOfk5KcwjaffoqtvmqwgSMf3V9EQeDzh7sQo_7KtwkpYqIVyURpvzckKAhROFP4SQU_s1tF7DpHHfzbtLlYHpvvGc1c-4pWOlZ-Pu50G57wI51NsI1f1ZbnPhYz-HOPd4dkMGCXYciZPVS1Y5s5GBPyg9I5I0KyQRSctzEk_db7Sd48OBeMzJtC7fiBSbht2NQ9ZoC54LJDASeu-nqPHrJJIFfapANuKyWdtpmkE_TOq4ox4zHGCbOxjmpC_c4P4jt0n9r3iKEEsH3olAMb963CBMxq1S3H2sDueCO-WlTL4uDKb7s7PjnmLVHxpnTM_KHoaqdndwcazfCWOHXIw6YlVJGV3hV44VWYQ0-oWj4", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "75168b0-66eb-4234-98e8-a49ecca3d067", "record_id": "flaws_cloudtrail:0000050:75168b0-66eb-4234-98e8-a49ecca3d067", "row_index": 50, "timestamp": "2018-04-17T21:28:07Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1281, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "75168b0-66eb-4234-98e8-a49ecca3d067", "eventTime": "2018-04-17T21:28:07Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "174fdb68-148d-4c52-ae2d-361addb60964", "record_id": "flaws_cloudtrail:0000051:174fdb68-148d-4c52-ae2d-361addb60964", "row_index": 51, "timestamp": "2018-04-17T21:28:07Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "174fdb68-148d-4c52-ae2d-361addb60964", "eventTime": "2018-04-17T21:28:07Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6a8d568b-536f-443f-95ea-a82f46db6607", "record_id": "flaws_cloudtrail:0000052:6a8d568b-536f-443f-95ea-a82f46db6607", "row_index": 52, "timestamp": "2018-04-17T21:28:08Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6a8d568b-536f-443f-95ea-a82f46db6607", "eventTime": "2018-04-17T21:28:08Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8327ad34-635c-4a07-9c94-720dbdcfdfe9", "record_id": "flaws_cloudtrail:0000053:8327ad34-635c-4a07-9c94-720dbdcfdfe9", "row_index": 53, "timestamp": "2018-04-17T21:28:08Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8327ad34-635c-4a07-9c94-720dbdcfdfe9", "eventTime": "2018-04-17T21:28:08Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a7380d14-30e0-47a1-871d-cbcd6d7fed67", "record_id": "flaws_cloudtrail:0000054:a7380d14-30e0-47a1-871d-cbcd6d7fed67", "row_index": 54, "timestamp": "2018-04-17T21:28:08Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1280, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a7380d14-30e0-47a1-871d-cbcd6d7fed67", "eventTime": "2018-04-17T21:28:08Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "db09286-6fab-498b-99c9-cfad733535cf", "record_id": "flaws_cloudtrail:0000055:db09286-6fab-498b-99c9-cfad733535cf", "row_index": 55, "timestamp": "2018-04-17T21:28:08Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "db09286-6fab-498b-99c9-cfad733535cf", "eventTime": "2018-04-17T21:28:08Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "83b67bcf-612c-4ab4-949e-65b4f86a956c", "record_id": "flaws_cloudtrail:0000056:83b67bcf-612c-4ab4-949e-65b4f86a956c", "row_index": 56, "timestamp": "2018-04-17T21:28:09Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1283, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "83b67bcf-612c-4ab4-949e-65b4f86a956c", "eventTime": "2018-04-17T21:28:09Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c6af49a-2ad5-488d-a553-fa773562e360b", "record_id": "flaws_cloudtrail:0000057:8c6af49a-2ad5-488d-a553-fa773562e360b", "row_index": 57, "timestamp": "2018-04-17T21:28:09Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1175, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c6af49a-2ad5-488d-a553-fa773562e360b", "eventTime": "2018-04-17T21:28:09Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "373dcd01-21d6-4df3-881c-8474c9e67411", "record_id": "flaws_cloudtrail:0000058:373dcd01-21d6-4df3-881c-8474c9e67411", "row_index": 58, "timestamp": "2018-04-17T21:28:09Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "373dcd01-21d6-4df3-881c-8474c9e67411", "eventTime": "2018-04-17T21:28:09Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f7d83fbd-405c-4bab-9ac6-fcebd0cd0d86", "record_id": "flaws_cloudtrail:0000059:f7d83fbd-405c-4bab-9ac6-fcebd0cd0d86", "row_index": 59, "timestamp": "2018-04-17T21:28:09Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f7d83fbd-405c-4bab-9ac6-fcebd0cd0d86", "eventTime": "2018-04-17T21:28:09Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6e448db7-011a-48a9-94a6-723e6b493012", "record_id": "flaws_cloudtrail:0000060:6e448db7-011a-48a9-94a6-723e6b493012", "row_index": 60, "timestamp": "2018-04-17T21:28:10Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1837, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6e448db7-011a-48a9-94a6-723e6b493012", "eventTime": "2018-04-17T21:28:10Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 01xJA6V2he8NLGaHGhl8pojJat8lsoAZb-TD6xLgh3wahvUfu4pQroj9VqoH7Hxyu2W77CLhGqp_2gFA_dJ0AiFmV-Pl8P5mfv6ziDph8ldfwwgaWlt4bCVuyGe2MhYK4roNJy_BfWdAEAhxotL30RrUMHu7Lb4itHQ43wAcuLWk9iEmmePikJSNSsVpAXfwmf5bam6xzG1JaFPlTbM847IRnS-zVjCE_aVUsOJ5lMFP-6Nyn4-esr6s2805KIdIuvjq9tMZkM5J1aXPINLN4_oJqEHCT39KuxBVfl3R_SXk80-nX8Nxafcp81ONJRb3CoqfaDhlT_jhsaRLeJNkq7BMNvKCh9Cw9gqc5QbcKL6_phlTfySUuYy7f7btssrdSE0yCLwXsPLRJ2yNPCOG2qBU1_4sgshoHlpQ4Igtdd_iho9QnEEDq3kmKcb7jqBrPliflmmGxNbjfydSoAiTDpB-nLrUz_nlXEaTtwp3tcnMw7tg4Mr7hWzIUIV0XNQBhCMevT53CgzI-oTE4RPONlXpqhU7rAvMwujo73GABA_RnUylMFleVCsWMke75_tgBqAA09RorVzbTaWeQv-OJdaiRnmvir81B2DertmIJmO9FEWbQ4km6SWK_4OZaF_EIeDojeX5PXw1r54bFivRDeHlz7SxdpQytYVIgQI", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dce1ef51-f37d-44f9-aa8d-c01954f8c95d", "record_id": "flaws_cloudtrail:0000061:dce1ef51-f37d-44f9-aa8d-c01954f8c95d", "row_index": 61, "timestamp": "2018-04-17T21:28:10Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1834, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dce1ef51-f37d-44f9-aa8d-c01954f8c95d", "eventTime": "2018-04-17T21:28:10Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: S30fPYq4kbkHGrPgLtj4jc5lMB1-hEgdrp5ewguexLjNytO4b7cMDyD6qgb_a8-iQGziBaKTDWpobmIRlSHWv8LhqE0Mw-5KNkUrtkYiW4oRyJPHBGpvz3sSbTni_aaFpZglT3CK_zhNdrFVmoHEtoYKQ1If1VPHCzs_DadvaiiBq0txoWWt-XKIs5sxFRlaClpOVqtaKBIoODuxhBiPbGHIcMA4pHTM1Rg3ZQl6nRqndZP3VZvv5BOuTcbSfre45luA0yuMcjPMriS8KoUo7slsCu81Yqb4mPJWEgHDBX0OjdZJBXQES8IWcAg5LQ_t0Jvgwyq8EsAfvKK6eWW_Uxc8SVn8sjVBiVXhtOkvVLu6AwNnFyvBDGk0wmq7qEw7Y_ycxbsHZn1LSx8aFzgDGTQzUe5gN4lAjlQ_E3DoH9BMQkHYxOPP4ZO8WgQHhmXakEv8bS6Duqct4saMPi3-hgrSGzcc90VYF0l5E3FekeNN7BunzLIaTNaL0ubAE6xQvywOciuNku5BOW7B1azu5haw1Vs7kVnOpq3JW--vreYRHpvRCMDNF4x6ZNvOfMPZ-hLYC-8peSCR_8-A1pywJ49iuDsLeOii87WEJB4tb38ErIRzqQg2qpScAFlxU6QbNnL3_COM1xG8gjvGY7nDptezcUkVSu9eiViBYg", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0c1a7c87-780c-4967-8cc9-8483fa793272", "record_id": "flaws_cloudtrail:0000062:0c1a7c87-780c-4967-8cc9-8483fa793272", "row_index": 62, "timestamp": "2018-04-17T21:28:11Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 812, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0c1a7c87-780c-4967-8cc9-8483fa793272", "eventTime": "2018-04-17T21:28:11Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "42ac285b-b538-4e70-a219-d8f1f87fb0f0", "record_id": "flaws_cloudtrail:0000063:42ac285b-b538-4e70-a219-d8f1f87fb0f0", "row_index": 63, "timestamp": "2018-04-17T21:28:11Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "42ac285b-b538-4e70-a219-d8f1f87fb0f0", "eventTime": "2018-04-17T21:28:11Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9ba67ee8-5d5e-4d5e-bbb3-f2bc901518c97", "record_id": "flaws_cloudtrail:0000064:9ba67ee8-5d5e-4d5e-bbb3-f2bc901518c97", "row_index": 64, "timestamp": "2018-04-17T21:28:11Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9ba67ee8-5d5e-4d5e-bbb3-f2bc901518c97", "eventTime": "2018-04-17T21:28:11Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "248210-9d88-441e-b82a-a6be915f0778", "record_id": "flaws_cloudtrail:0000065:248210-9d88-441e-b82a-a6be915f0778", "row_index": 65, "timestamp": "2018-04-17T21:28:11Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1275, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "248210-9d88-441e-b82a-a6be915f0778", "eventTime": "2018-04-17T21:28:11Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fada5253-428b-4965-8682-afd2c8767cfa", "record_id": "flaws_cloudtrail:0000066:fada5253-428b-4965-8682-afd2c8767cfa", "row_index": 66, "timestamp": "2018-04-17T21:28:12Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fada5253-428b-4965-8682-afd2c8767cfa", "eventTime": "2018-04-17T21:28:12Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ca82ac7d-5dad-4574-937e-c966c74c8f37", "record_id": "flaws_cloudtrail:0000067:ca82ac7d-5dad-4574-937e-c966c74c8f37", "row_index": 67, "timestamp": "2018-04-17T21:28:12Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ca82ac7d-5dad-4574-937e-c966c74c8f37", "eventTime": "2018-04-17T21:28:12Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2111bbd9-562f-40a9-8ad7-bd39b8cdcd29", "record_id": "flaws_cloudtrail:0000068:2111bbd9-562f-40a9-8ad7-bd39b8cdcd29", "row_index": 68, "timestamp": "2018-04-17T21:28:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2111bbd9-562f-40a9-8ad7-bd39b8cdcd29", "eventTime": "2018-04-17T21:28:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "528f179c-00b1-4b23-9976-e72997e8817f", "record_id": "flaws_cloudtrail:0000069:528f179c-00b1-4b23-9976-e72997e8817f", "row_index": 69, "timestamp": "2018-04-17T21:28:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "528f179c-00b1-4b23-9976-e72997e8817f", "eventTime": "2018-04-17T21:28:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b4311e1f-2525-4865-a3f1-d633f6d060a2", "record_id": "flaws_cloudtrail:0000070:b4311e1f-2525-4865-a3f1-d633f6d060a2", "row_index": 70, "timestamp": "2018-04-17T21:28:13Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b4311e1f-2525-4865-a3f1-d633f6d060a2", "eventTime": "2018-04-17T21:28:13Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f0da20b0-1919-4350-8941-7634c6dbcb35", "record_id": "flaws_cloudtrail:0000071:f0da20b0-1919-4350-8941-7634c6dbcb35", "row_index": 71, "timestamp": "2018-04-17T21:28:14Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f0da20b0-1919-4350-8941-7634c6dbcb35", "eventTime": "2018-04-17T21:28:14Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7c1c12d2-2745-4cff-833e-a73fb506e543", "record_id": "flaws_cloudtrail:0000072:7c1c12d2-2745-4cff-833e-a73fb506e543", "row_index": 72, "timestamp": "2018-04-17T21:28:14Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7c1c12d2-2745-4cff-833e-a73fb506e543", "eventTime": "2018-04-17T21:28:14Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "92d2de41-a73d-4d24-b64b-965289b7b788", "record_id": "flaws_cloudtrail:0000073:92d2de41-a73d-4d24-b64b-965289b7b788", "row_index": 73, "timestamp": "2018-04-17T21:28:14Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1828, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "92d2de41-a73d-4d24-b64b-965289b7b788", "eventTime": "2018-04-17T21:28:14Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: UYi_SVDdmrdOXlKxCsTafsqNvnL1OvpKXUGMvMTtY_7G_i_0fpCvZcURFFPumqXYOOB32di-aNEmA-TvDmoAq-Kfm_HrmKZmUFuPzZ08DiVgpFGD2jJYOiJez6cJ1GHrxvEfupIt4Jv1EgfeNuj3QMFVCHdyw27d9YbjGp16llMHBGuHgYoJHCDadcZ8-xO4Kgw6E1W4Tbe3j7mHjWe_CIl5xcHEEnmcnR30qAWGHe5JnbwmkdrWiwunSWXEKC1abkH8lpDTu1Yx_Q8mcJKT8khF4HJgStToldEdJpSbU2_qcHX4ndttN-s97dtbh50smJl4O_-h6EmMa4AMTHrDuXTaxmCBBu8p7c-C5YtEfYD3v2Vt5kD3JAjgTuWW1Bkx3sCFl6alFgeMu3OshgAsvgvjtx6CLPPOzFG3DxON2khAWJr098oXt_EThqDm1wVf18fx6vcfTxv0D15ryszftecCCa2o232Y-b7vhuDu5N6L_6XsxwebNkRAepVkjN7HXMDwMNUsaUITNQuxk5UM2tXhqnAV5aQunrxTvkgAfBfl7akZ-vgABRAi-GAp5358SxvF0YtP9dQaFOCfyVqR_vPF29RpgduHl0y0JLugYfEWqjtZ_z4jtgeAYbNAi9Bjwtdlzo9wRN980YGAz0tUZx0oIL0zALQytXw", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2cecbafc-c012-465f-b96a-f69cb65bfa6d", "record_id": "flaws_cloudtrail:0000074:2cecbafc-c012-465f-b96a-f69cb65bfa6d", "row_index": 74, "timestamp": "2018-04-17T21:28:15Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2cecbafc-c012-465f-b96a-f69cb65bfa6d", "eventTime": "2018-04-17T21:28:15Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "57c7ae5f-bfaf-48f5-b0b1-a382d08bd100", "record_id": "flaws_cloudtrail:0000075:57c7ae5f-bfaf-48f5-b0b1-a382d08bd100", "row_index": 75, "timestamp": "2018-04-17T21:28:15Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "57c7ae5f-bfaf-48f5-b0b1-a382d08bd100", "eventTime": "2018-04-17T21:28:15Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c1f9b8b9-3679-402f-b1f2-5dab13247", "record_id": "flaws_cloudtrail:0000076:c1f9b8b9-3679-402f-b1f2-5dab13247", "row_index": 76, "timestamp": "2018-04-17T21:28:15Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c1f9b8b9-3679-402f-b1f2-5dab13247", "eventTime": "2018-04-17T21:28:15Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "864afaf0-0112-4a7c-85cd-cabd3a7c2b7a", "record_id": "flaws_cloudtrail:0000077:864afaf0-0112-4a7c-85cd-cabd3a7c2b7a", "row_index": 77, "timestamp": "2018-04-17T21:28:15Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "864afaf0-0112-4a7c-85cd-cabd3a7c2b7a", "eventTime": "2018-04-17T21:28:15Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2b48fd73-e862-443a-a282-d75383ab6d47", "record_id": "flaws_cloudtrail:0000078:2b48fd73-e862-443a-a282-d75383ab6d47", "row_index": 78, "timestamp": "2018-04-17T21:28:15Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2b48fd73-e862-443a-a282-d75383ab6d47", "eventTime": "2018-04-17T21:28:15Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2f1caee2-b4f9-43aa-bc8c-5800512a77a4", "record_id": "flaws_cloudtrail:0000079:2f1caee2-b4f9-43aa-bc8c-5800512a77a4", "row_index": 79, "timestamp": "2018-04-17T21:28:16Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2f1caee2-b4f9-43aa-bc8c-5800512a77a4", "eventTime": "2018-04-17T21:28:16Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2174badb-f701-4c5f-ba1b-759125294a52", "record_id": "flaws_cloudtrail:0000080:2174badb-f701-4c5f-ba1b-759125294a52", "row_index": 80, "timestamp": "2018-04-17T21:28:16Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2174badb-f701-4c5f-ba1b-759125294a52", "eventTime": "2018-04-17T21:28:16Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "27ba65b2-38d1-4b75-b19e-1322bfb89b7a", "record_id": "flaws_cloudtrail:0000081:27ba65b2-38d1-4b75-b19e-1322bfb89b7a", "row_index": 81, "timestamp": "2018-04-17T21:28:16Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1171, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "27ba65b2-38d1-4b75-b19e-1322bfb89b7a", "eventTime": "2018-04-17T21:28:16Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "03445-71ad-4e4b-962d-e92c8b931e24", "record_id": "flaws_cloudtrail:0000082:03445-71ad-4e4b-962d-e92c8b931e24", "row_index": 82, "timestamp": "2018-04-17T21:28:17Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1275, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "03445-71ad-4e4b-962d-e92c8b931e24", "eventTime": "2018-04-17T21:28:17Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a9c9a8f2-8cea-4f8b-8512-d56161d780", "record_id": "flaws_cloudtrail:0000083:a9c9a8f2-8cea-4f8b-8512-d56161d780", "row_index": 83, "timestamp": "2018-04-17T21:28:17Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a9c9a8f2-8cea-4f8b-8512-d56161d780", "eventTime": "2018-04-17T21:28:17Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a3d0f8d2-fdff-4559-96c1-e4111e0c12bf", "record_id": "flaws_cloudtrail:0000084:a3d0f8d2-fdff-4559-96c1-e4111e0c12bf", "row_index": 84, "timestamp": "2018-04-17T21:28:17Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a3d0f8d2-fdff-4559-96c1-e4111e0c12bf", "eventTime": "2018-04-17T21:28:17Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1e9d55f0-5f4b-4c73-a26c-c6467ea265d3", "record_id": "flaws_cloudtrail:0000085:1e9d55f0-5f4b-4c73-a26c-c6467ea265d3", "row_index": 85, "timestamp": "2018-04-17T21:28:18Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1e9d55f0-5f4b-4c73-a26c-c6467ea265d3", "eventTime": "2018-04-17T21:28:18Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "264dd15d-480a-477d-b66c-11a1e6a1a038", "record_id": "flaws_cloudtrail:0000086:264dd15d-480a-477d-b66c-11a1e6a1a038", "row_index": 86, "timestamp": "2018-04-17T21:28:18Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "264dd15d-480a-477d-b66c-11a1e6a1a038", "eventTime": "2018-04-17T21:28:18Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b2aec994-7698-4467-8f07-038f17a974667", "record_id": "flaws_cloudtrail:0000087:b2aec994-7698-4467-8f07-038f17a974667", "row_index": 87, "timestamp": "2018-04-17T21:28:18Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1828, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b2aec994-7698-4467-8f07-038f17a974667", "eventTime": "2018-04-17T21:28:18Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: ui20kV_0KmS2yyOO1ytokHpFE0q1TkBV9GErwWo-R3PPGE731vcUY8ZG__SMGUP1Xb5f0k0uCnCIRSGIWPr3muyr0j6WNltlHMcaWrs8bwKxj76o-efJbE_7-HkrMQ2aX-5GP80PFmO72vuiwN1hmUWi2E2Rrl1zXaq3GHdTNg5MGUTki9SbfWouDeSx-mESocAj5FzUpXpg0WNR2pcxWpl1LUcegqeOCgu1QsXNLGtQhGDsBE2xRUE6J1_TvwcAUpl3t23doBDCohC0-NHn5Kjxr3yH7dae5b7rXjwJsqkRNMFACaf1IaHj45MifcxT-kcQJMUPcolFViFvhwKhF_ej8B1NuZFYUlGFyM5QEoB-FgdoaWHoy1cPSyDu6F6eme1xjV-jM5Y0AoQbtVKhznVNfTLC82_PpTWcpOJRa6NQbpPlYzTOHaf9sc80bUhslGX0mTyowhkky7F_dd7i9lKbs5qawmnpCK6r3BArOS5TYyLcGPltx-eF3E0SOEUOY9PtJfxij7zbFYxJWusT2PKsRTPxbIf6auIIAPMoRaPlwmQjSrF-j76rXjcTcCQ3BG9fmHzPNBfV-f1RSCiBiCyIFHYT8rF32rlXTbVR7AhYsgAfXseYn28KKBUyCkOCFeMPR1ZPMO_nR5d_ZpyWGZe5BTNd9krD-w", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f83890-0dcb-4f2a-82a5-59e199390c514", "record_id": "flaws_cloudtrail:0000088:f83890-0dcb-4f2a-82a5-59e199390c514", "row_index": 88, "timestamp": "2018-04-17T21:28:19Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1279, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f83890-0dcb-4f2a-82a5-59e199390c514", "eventTime": "2018-04-17T21:28:19Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "217dc2b9-57d8-4db8-81e0-b7f79ac8786d", "record_id": "flaws_cloudtrail:0000089:217dc2b9-57d8-4db8-81e0-b7f79ac8786d", "row_index": 89, "timestamp": "2018-04-17T21:28:19Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "217dc2b9-57d8-4db8-81e0-b7f79ac8786d", "eventTime": "2018-04-17T21:28:19Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c94e182a-a7f3-457a-9a29-91af9c370d2a", "record_id": "flaws_cloudtrail:0000090:c94e182a-a7f3-457a-9a29-91af9c370d2a", "row_index": 90, "timestamp": "2018-04-17T21:28:19Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c94e182a-a7f3-457a-9a29-91af9c370d2a", "eventTime": "2018-04-17T21:28:19Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f2b675243-20e3-4ba6-8b1c-768ebbe00329", "record_id": "flaws_cloudtrail:0000091:f2b675243-20e3-4ba6-8b1c-768ebbe00329", "row_index": 91, "timestamp": "2018-04-17T21:28:19Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f2b675243-20e3-4ba6-8b1c-768ebbe00329", "eventTime": "2018-04-17T21:28:19Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c453a7aa-c0ef-4958-bd38-6dc71d532ca0", "record_id": "flaws_cloudtrail:0000092:c453a7aa-c0ef-4958-bd38-6dc71d532ca0", "row_index": 92, "timestamp": "2018-04-17T21:28:20Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1172, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c453a7aa-c0ef-4958-bd38-6dc71d532ca0", "eventTime": "2018-04-17T21:28:20Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4fad3d85-cb58-4b54-8082-3e5281e8aeec", "record_id": "flaws_cloudtrail:0000093:4fad3d85-cb58-4b54-8082-3e5281e8aeec", "row_index": 93, "timestamp": "2018-04-17T21:28:20Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1280, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4fad3d85-cb58-4b54-8082-3e5281e8aeec", "eventTime": "2018-04-17T21:28:20Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9624eec7-f5ab-4901-8a7f-0c9ba691aae3", "record_id": "flaws_cloudtrail:0000094:9624eec7-f5ab-4901-8a7f-0c9ba691aae3", "row_index": 94, "timestamp": "2018-04-17T21:28:20Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9624eec7-f5ab-4901-8a7f-0c9ba691aae3", "eventTime": "2018-04-17T21:28:20Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c8070d2e-b754-489b-b4a3-f34f193eee62", "record_id": "flaws_cloudtrail:0000095:c8070d2e-b754-489b-b4a3-f34f193eee62", "row_index": 95, "timestamp": "2018-04-17T21:28:20Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c8070d2e-b754-489b-b4a3-f34f193eee62", "eventTime": "2018-04-17T21:28:20Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "41f8f29d-cf70-47e2-82cd-9be2664c91d3", "record_id": "flaws_cloudtrail:0000096:41f8f29d-cf70-47e2-82cd-9be2664c91d3", "row_index": 96, "timestamp": "2018-04-17T21:28:21Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1171, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "41f8f29d-cf70-47e2-82cd-9be2664c91d3", "eventTime": "2018-04-17T21:28:21Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d8062e57-28c4-4fc3-bf3a-fd364f853009", "record_id": "flaws_cloudtrail:0000097:d8062e57-28c4-4fc3-bf3a-fd364f853009", "row_index": 97, "timestamp": "2018-04-17T21:28:21Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1827, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d8062e57-28c4-4fc3-bf3a-fd364f853009", "eventTime": "2018-04-17T21:28:21Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: aDEbNf0sOYHjN0I0gmhZUQg5Xfa_TkSaBUvIN1oJ7ELdjiASVjsDvrcqmsP5O2yxQc5WT3yg33NUxtGs6Xlpb9zvSjK7Y-Ciu8Cnd0MSEgCYg9UWujDQYtIFDHlWU04NVbekRh-UhHLJBa7lGEpMtP4Aws1x9sN8INgYpWBeqyjqh1Rjn-Sr4NG3lvFDVtTpFRTDGOmRnMd7FiqBpCwdAL9D7hj2iwea1HhSO5MfZjpGst_dgh8doxgnN3j8mkkIY_3jiQcZpSkFlnQm8iIt4ylZky0y4agWKnFzLOYn21W3F3BhhCIk8u347JVUxJMj7jO3KnP_3_u_owTfEfr30Trfq0igU-EJeW8oz81k7bWX98xqbxVqAfQxRe_23XF-VNadEBBOM8-58RiZgfDotFHV_ZAbSZxzA7YBZQ7Mnj9PhCalpYlx9ht-fZga16sDD1_iSrK0-qFuxo9YX8JaMMB7M7yrOuTb_FPEJqQ9l8ODbeNiBUkVPMSIM8HPDcxu8SoLLyrl0IiUbXlxYHy8fb_gvaQcU_F6R7dXBC-IyfoREaLxIrS4PqtByOvjsNEebTbFBzNsPkibSUYmSowVrgEPfMAjJDcOALW_oMHzudD5QC_u4xl_RY5Bm4DL9fY7FPiQ9TjqqHxtJzWYkH5zBidjAZvZEYKuQw", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "83e310bd-bfef-4d5c-aea7-83f19c0c071b", "record_id": "flaws_cloudtrail:0000098:83e310bd-bfef-4d5c-aea7-83f19c0c071b", "row_index": 98, "timestamp": "2018-04-17T21:28:21Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "83e310bd-bfef-4d5c-aea7-83f19c0c071b", "eventTime": "2018-04-17T21:28:21Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bef8994e-b70f-4a9f-bd7b-e65d70df6e64", "record_id": "flaws_cloudtrail:0000099:bef8994e-b70f-4a9f-bd7b-e65d70df6e64", "row_index": 99, "timestamp": "2018-04-17T21:28:22Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1830, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bef8994e-b70f-4a9f-bd7b-e65d70df6e64", "eventTime": "2018-04-17T21:28:22Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: e7qY1lTInxDefdg5Xc2cN3b8j8oIJ-XMIgsbMybjT-XNZ5Hev1qvxkEDexZujk10XFa0k8OI-g7fqHH4mFsV02FSUP0ZrYtGtALuS5ct8O19Yc_8uoa3gmHhJcb9_LdbxWoPq1dXyJHbEW6vFukycp0rqjE9UEImq-MH8woMnZoVTVmfjDhJTLmUYDkY6Zvvcx9NIBEpOWz07ijTo1qGyOE3oN7n5tj0XrMBksXoWag2hdtkAhucsoLU2AiPHww91CRlOgEpMZ2NDPklyC9nEzHA7bUAkcTID1ONjZWXQHaeM7dpr_eYcUwiiB0jSLehvF86EXjVWHhVRZh6wwGYDHbE9eAxlCOQjWVzLIEOkHR8-oYf3_iBRWRqTK3QUDuXr1p_3esPhoYgJjr1D552KqqnKCmE02BWlNKBkIe5NMqReFHFC4vjbRrFehAKXu0nfLnwo0MogRl7NaqkLQqfgTcEJ9db1VruoskllcCtx8oViDIRU7o5PIJDsYvmPT8D2BT26yGw7qwdhMHwfycpAgVLSG1ND0wLZ-gOeFIvg0gX3_WdGLWm3myo_G6ZlWBxFfgQWkJH-QKIbOvzfjSd8JRcFvNxU6M511JbNjT87QfJ2yoHgLchFXFYJFAg546OlceLOJnHi-LrCqfyauQ5ecskcyAp1jUCrEZ_", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8356acc2-ea3a-4367-b451-dca0e09862c5", "record_id": "flaws_cloudtrail:0000100:8356acc2-ea3a-4367-b451-dca0e09862c5", "row_index": 100, "timestamp": "2018-04-17T21:28:22Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8356acc2-ea3a-4367-b451-dca0e09862c5", "eventTime": "2018-04-17T21:28:22Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "05a4c221-218f-4e30-9c47-56eb19c375f8", "record_id": "flaws_cloudtrail:0000101:05a4c221-218f-4e30-9c47-56eb19c375f8", "row_index": 101, "timestamp": "2018-04-17T21:28:23Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1835, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "05a4c221-218f-4e30-9c47-56eb19c375f8", "eventTime": "2018-04-17T21:28:23Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: v0VYMMNC0zeu9U-i_1Z8MOrFI0XIZ3hDcPjQ8BAaq4R5ijr8efsVpDH5TNwoi4CSnKPFfcrBoGRIvb7LEQ1xK3mrD4JvkWvf3T5syco3ddnfJL-1wjQxoaY5k6nnnfQ1FwgIlCvfTOfZuQG7bTT_vfiTYuOwHL9H5YLmHjGZumlhTvEjSegfLL0sxuDt8Ib3nWOPvO0bokTIVpKoJlA1IPTOaeLKRUXjvRJzI5PXJOGRry8jkOqPphey8Rb42ct83TJ-sJ9wNgvmXEAjw8GeJg6HMf30yT1Hg54C_qYJ3ghx-Ult_ySOVxSm_kKaRh-R7KiJ7h8TQ9dmNJqDTzzZjuNkt_S_xmLvW6WgaG1EIUzhOd1SdS0JyHp1z3ooWadMkfWTph39sVBHINFyQTqqOu6Eho99wwcK3oKHHSpQSPeKEMs1HmN37-mtCcJY8VWu4QhnSgFzrbSUkfhSj2mgrRGleplVt90sfF0gLNTQufd1zvUi-6b9E8UgblZlCmZnYg9KRU1--Q4QTpv1TaWNxNcip0ylJg2zaSEXJNSMjo_I--2Bo2HsXKw_NcGmF5R0F2jyBt4mdSzfBa0DYQCY9iEbx--YJ8eoargx9ivrRjgUe3t8szvEOyA4avyGKoswskx0oxfSjtq7Jr5Nw0CKq03C4PBlHGH1mvQ0Qg", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "47ce33ea-c695-42d8-8e71-42c16bd850308", "record_id": "flaws_cloudtrail:0000102:47ce33ea-c695-42d8-8e71-42c16bd850308", "row_index": 102, "timestamp": "2018-04-17T21:28:23Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "47ce33ea-c695-42d8-8e71-42c16bd850308", "eventTime": "2018-04-17T21:28:23Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d40849-6f76-4072-a201-692c6c27c735", "record_id": "flaws_cloudtrail:0000103:d40849-6f76-4072-a201-692c6c27c735", "row_index": 103, "timestamp": "2018-04-17T21:28:24Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1275, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d40849-6f76-4072-a201-692c6c27c735", "eventTime": "2018-04-17T21:28:24Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8ee9c239-90ba-4faf-833e-957e16e7da91", "record_id": "flaws_cloudtrail:0000104:8ee9c239-90ba-4faf-833e-957e16e7da91", "row_index": 104, "timestamp": "2018-04-17T21:28:25Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1171, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8ee9c239-90ba-4faf-833e-957e16e7da91", "eventTime": "2018-04-17T21:28:25Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "294449cd9-b34c-4bca-9c2e-9455e317b14b", "record_id": "flaws_cloudtrail:0000105:294449cd9-b34c-4bca-9c2e-9455e317b14b", "row_index": 105, "timestamp": "2018-04-17T21:28:25Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "294449cd9-b34c-4bca-9c2e-9455e317b14b", "eventTime": "2018-04-17T21:28:25Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6dcc0b85-58b6-4600-9438-90d292ef49fe", "record_id": "flaws_cloudtrail:0000106:6dcc0b85-58b6-4600-9438-90d292ef49fe", "row_index": 106, "timestamp": "2018-04-17T21:28:26Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1826, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6dcc0b85-58b6-4600-9438-90d292ef49fe", "eventTime": "2018-04-17T21:28:26Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: eGDTdTY05u3VWKHzZpuMJlxgOiAISNpqIjqm1NZTmM7vk2K5FOJqmg_5yRsyuVY6ALqh-YNuYOku2WTv4NmHazM66Zg9Wv3XASfwMvn2ze5j2Wa7v4moOfskcUuNHIug5EUKyBkV-u6jWcNP-3W-iYrrkxceVX7JY80l3KLPizsthxyDKIECmtECA1shDvc6_Yv50e6xJYi7CDjabGbTxOfjuUIHhAMrpPp7XW8o05jYufj7Hg3DMLrXpKrNXlqaYzQmc6TH5eKqTiDPtIS7iRpL18qlpgeQqxZHlLUqnL5CxDyqqEMuVkyupCT5bSAvkt9olpnDdF8_Ezyh3NLzu-1BAF4Q6C23vz71As0FDMj8zncBcEQWVOtTJHXGbA-OQusgA1XkosfdaAI602SKRhh5ZVpiFOcUEJ5-PEU1eVGZwUZhRjxcfWUFGri1mPRpmJ6tskKhKmVUUYAbw2fVYjrhBKcrMMBKOD_LdTz8sPq005PvH4TgKMOl5fR1U2cI8zlsgD1IaRyK0MxiZzzM4mWJDAyNGdVTMlHpmez5EYQQJdAyaxSIkg5Q5q8boGQTIDQCp43311cgVJEcbkaF3LXeAN_ZpxwMxmukAgBAtO3Wz8bs_FoGAS6PFqR7berQp8yswYBTwwfljTWYI-MTPNep_12ViAx4jw", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d141bf2a-f929-4c45-b308-06b4029e4caf", "record_id": "flaws_cloudtrail:0000107:d141bf2a-f929-4c45-b308-06b4029e4caf", "row_index": 107, "timestamp": "2018-04-17T21:28:26Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d141bf2a-f929-4c45-b308-06b4029e4caf", "eventTime": "2018-04-17T21:28:26Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7e8d1792-634f-435a-8fe7-a78a25cf8c80", "record_id": "flaws_cloudtrail:0000108:7e8d1792-634f-435a-8fe7-a78a25cf8c80", "row_index": 108, "timestamp": "2018-04-17T21:28:27Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7e8d1792-634f-435a-8fe7-a78a25cf8c80", "eventTime": "2018-04-17T21:28:27Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c57f80cf-73b9-4d27-b068-afb5b4d0cf0c", "record_id": "flaws_cloudtrail:0000109:c57f80cf-73b9-4d27-b068-afb5b4d0cf0c", "row_index": 109, "timestamp": "2018-04-17T21:28:28Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c57f80cf-73b9-4d27-b068-afb5b4d0cf0c", "eventTime": "2018-04-17T21:28:28Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d089bc47-6b4b-4a1e-8fa0-3ebc01c9f7c9", "record_id": "flaws_cloudtrail:0000110:d089bc47-6b4b-4a1e-8fa0-3ebc01c9f7c9", "row_index": 110, "timestamp": "2018-04-17T21:28:30Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1171, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d089bc47-6b4b-4a1e-8fa0-3ebc01c9f7c9", "eventTime": "2018-04-17T21:28:30Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cd05de2c-0b74-4b31-8680-60131eed", "record_id": "flaws_cloudtrail:0000111:cd05de2c-0b74-4b31-8680-60131eed", "row_index": 111, "timestamp": "2018-04-17T21:28:31Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1821, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cd05de2c-0b74-4b31-8680-60131eed", "eventTime": "2018-04-17T21:28:31Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 63zDU28pYJnMFxaQCoQowWJMF_TbYr9eRd2OnAOQcl6I63CFTwQwrGM-NqkGEbcTwP4oqeT6NKvVvIKbX8oOvOzmSNukCk7ML05cCjQLlxDRcHcDve1BrO1fiWZ4-hRqVtrDPLF15gNv7gkXZrXUNQDCNlkm-5sUptyqY1kSiwqHWMOIfDUUx2lmf0n2xIACWaPQSlyyTyKgH2yuw2Ed2zsP4pj-3MpcS6goIP6Ltr4D9jhbKQ0W43eQKwx8ORNsesDbH0DOyMAVqCBetX-uDSRZSpykjr268FnkZTWTn9NZ0pvtaZH12VIet2kqcNpJcmZZArbcJsPIyXoqrmUF13seK1Qe5Grdl5lReDtNHVxqSxIDAV0qWLIYPn-xFs4zOtDZwKDTxY-b07qkj73E_yUmPnVvwTCryqX85h3iQU58SLQ3H5YEWWZ3PgIddzM67ZRtos-fnpgDy7DRZOU8K-lBQLEqCflUuh_I5ItIwEGZvmH1fnJxtiqeU7XWWzNZ_VBF3eh7Y94cMty0iceeCecEoVvs1_4WOePyzbMbUSRpiyWjXkigAA1eaZf4YCrmzq_G6IwDkH2QPGUM8RQrfDgyWgiY2yfbZRbdHoG9IrZIDT8NabAEaMZ4Vcg19T5AlvKciWST6wDskodtst6WR-2hGPfaDLN-2GM", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3c9cd0e3-a3de-4d9f-a089-316a871f4c00", "record_id": "flaws_cloudtrail:0000112:3c9cd0e3-a3de-4d9f-a089-316a871f4c00", "row_index": 112, "timestamp": "2018-04-17T21:39:44Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 775, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3c9cd0e3-a3de-4d9f-a089-316a871f4c00", "eventTime": "2018-04-17T21:39:44Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bd975269-10cb-4927-8eba-6746b7937b2a", "record_id": "flaws_cloudtrail:0000113:bd975269-10cb-4927-8eba-6746b7937b2a", "row_index": 113, "timestamp": "2018-04-17T21:39:45Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bd975269-10cb-4927-8eba-6746b7937b2a", "eventTime": "2018-04-17T21:39:45Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0544c50f-aed3-4fee-9417-919207e9d98", "record_id": "flaws_cloudtrail:0000114:0544c50f-aed3-4fee-9417-919207e9d98", "row_index": 114, "timestamp": "2018-04-17T21:39:46Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 813, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0544c50f-aed3-4fee-9417-919207e9d98", "eventTime": "2018-04-17T21:39:46Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "77b375a7-cce2-47d7-b26b-82354b19b6e7", "record_id": "flaws_cloudtrail:0000115:77b375a7-cce2-47d7-b26b-82354b19b6e7", "row_index": 115, "timestamp": "2018-04-17T21:39:46Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 814, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "77b375a7-cce2-47d7-b26b-82354b19b6e7", "eventTime": "2018-04-17T21:39:46Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "330871-3ba0-4272-aa40-518cca153ff3", "record_id": "flaws_cloudtrail:0000116:330871-3ba0-4272-aa40-518cca153ff3", "row_index": 116, "timestamp": "2018-04-17T21:39:46Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 807, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "330871-3ba0-4272-aa40-518cca153ff3", "eventTime": "2018-04-17T21:39:46Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "78e451e3-6632-4423-b93b-5ca7745a1a7e", "record_id": "flaws_cloudtrail:0000117:78e451e3-6632-4423-b93b-5ca7745a1a7e", "row_index": 117, "timestamp": "2018-04-17T21:39:46Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "78e451e3-6632-4423-b93b-5ca7745a1a7e", "eventTime": "2018-04-17T21:39:46Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8dd31a1e-1240-4a5b-841a-390e269fd1ee", "record_id": "flaws_cloudtrail:0000118:8dd31a1e-1240-4a5b-841a-390e269fd1ee", "row_index": 118, "timestamp": "2018-04-17T21:39:47Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8dd31a1e-1240-4a5b-841a-390e269fd1ee", "eventTime": "2018-04-17T21:39:47Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "095d2546-cd38-4352-ae09-6ac99c379b29", "record_id": "flaws_cloudtrail:0000119:095d2546-cd38-4352-ae09-6ac99c379b29", "row_index": 119, "timestamp": "2018-04-17T21:39:49Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 710, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "095d2546-cd38-4352-ae09-6ac99c379b29", "eventTime": "2018-04-17T21:39:49Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fbe3a8ab-6854-4285-9d45-b86f170880e2", "record_id": "flaws_cloudtrail:0000120:fbe3a8ab-6854-4285-9d45-b86f170880e2", "row_index": 120, "timestamp": "2018-04-17T21:39:50Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 710, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fbe3a8ab-6854-4285-9d45-b86f170880e2", "eventTime": "2018-04-17T21:39:50Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "83524ea-506d-4db3-b91a-a59afa4dd295", "record_id": "flaws_cloudtrail:0000121:83524ea-506d-4db3-b91a-a59afa4dd295", "row_index": 121, "timestamp": "2018-04-17T21:39:50Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "83524ea-506d-4db3-b91a-a59afa4dd295", "eventTime": "2018-04-17T21:39:50Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "71f682c0-7e2f-4cc5-b4e8-67c96fb13be7", "record_id": "flaws_cloudtrail:0000122:71f682c0-7e2f-4cc5-b4e8-67c96fb13be7", "row_index": 122, "timestamp": "2018-04-17T21:39:50Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "71f682c0-7e2f-4cc5-b4e8-67c96fb13be7", "eventTime": "2018-04-17T21:39:50Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "646a7452-6e44-49bd-98f5-f6d3f03b83df", "record_id": "flaws_cloudtrail:0000123:646a7452-6e44-49bd-98f5-f6d3f03b83df", "row_index": 123, "timestamp": "2018-04-17T21:39:50Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "646a7452-6e44-49bd-98f5-f6d3f03b83df", "eventTime": "2018-04-17T21:39:50Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fa5c5221-f468-43e7-be03-6dba982adf6e", "record_id": "flaws_cloudtrail:0000124:fa5c5221-f468-43e7-be03-6dba982adf6e", "row_index": 124, "timestamp": "2018-04-17T21:39:50Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fa5c5221-f468-43e7-be03-6dba982adf6e", "eventTime": "2018-04-17T21:39:50Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "621a5f51-0b86-48f9-98fd-8b45d6287538", "record_id": "flaws_cloudtrail:0000125:621a5f51-0b86-48f9-98fd-8b45d6287538", "row_index": 125, "timestamp": "2018-04-17T21:39:50Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "621a5f51-0b86-48f9-98fd-8b45d6287538", "eventTime": "2018-04-17T21:39:50Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "adb87374-2e21-45df-9c82-158c0b816e25", "record_id": "flaws_cloudtrail:0000126:adb87374-2e21-45df-9c82-158c0b816e25", "row_index": 126, "timestamp": "2018-04-17T21:39:50Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "adb87374-2e21-45df-9c82-158c0b816e25", "eventTime": "2018-04-17T21:39:50Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2b11fe1b-daa8-498c-a151-01eb34dc477d", "record_id": "flaws_cloudtrail:0000127:2b11fe1b-daa8-498c-a151-01eb34dc477d", "row_index": 127, "timestamp": "2018-04-17T21:39:51Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2b11fe1b-daa8-498c-a151-01eb34dc477d", "eventTime": "2018-04-17T21:39:51Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "55da3f6f-1bcb-436c-bec3-9ec40288b9a", "record_id": "flaws_cloudtrail:0000128:55da3f6f-1bcb-436c-bec3-9ec40288b9a", "row_index": 128, "timestamp": "2018-04-17T21:39:51Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1281, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "55da3f6f-1bcb-436c-bec3-9ec40288b9a", "eventTime": "2018-04-17T21:39:51Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e6a729cf-6f6c-4ce2-848b-8b6c0020772b", "record_id": "flaws_cloudtrail:0000129:e6a729cf-6f6c-4ce2-848b-8b6c0020772b", "row_index": 129, "timestamp": "2018-04-17T21:39:51Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e6a729cf-6f6c-4ce2-848b-8b6c0020772b", "eventTime": "2018-04-17T21:39:51Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "202c364f-971e-4604-b38a-9ceee2c9d2fd", "record_id": "flaws_cloudtrail:0000130:202c364f-971e-4604-b38a-9ceee2c9d2fd", "row_index": 130, "timestamp": "2018-04-17T21:39:51Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "202c364f-971e-4604-b38a-9ceee2c9d2fd", "eventTime": "2018-04-17T21:39:51Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "941eb783-aa8c-4d93-be7d-0d1aa353b670", "record_id": "flaws_cloudtrail:0000131:941eb783-aa8c-4d93-be7d-0d1aa353b670", "row_index": 131, "timestamp": "2018-04-17T21:39:51Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "941eb783-aa8c-4d93-be7d-0d1aa353b670", "eventTime": "2018-04-17T21:39:51Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f5bb9b09-3173-45e0-8f73-d1ed63d1c390", "record_id": "flaws_cloudtrail:0000132:f5bb9b09-3173-45e0-8f73-d1ed63d1c390", "row_index": 132, "timestamp": "2018-04-17T21:39:51Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f5bb9b09-3173-45e0-8f73-d1ed63d1c390", "eventTime": "2018-04-17T21:39:51Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "14c571933-b9d3-4b5e-a7b1-0d50f77e448c", "record_id": "flaws_cloudtrail:0000133:14c571933-b9d3-4b5e-a7b1-0d50f77e448c", "row_index": 133, "timestamp": "2018-04-17T21:39:52Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1280, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "14c571933-b9d3-4b5e-a7b1-0d50f77e448c", "eventTime": "2018-04-17T21:39:52Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0ea142568-b4df-41bf-ada7-2920e29a5d2b", "record_id": "flaws_cloudtrail:0000134:0ea142568-b4df-41bf-ada7-2920e29a5d2b", "row_index": 134, "timestamp": "2018-04-17T21:39:52Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1284, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0ea142568-b4df-41bf-ada7-2920e29a5d2b", "eventTime": "2018-04-17T21:39:52Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f0fba98f-6248-444c-8847-5627ac903af3", "record_id": "flaws_cloudtrail:0000135:f0fba98f-6248-444c-8847-5627ac903af3", "row_index": 135, "timestamp": "2018-04-17T21:39:52Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f0fba98f-6248-444c-8847-5627ac903af3", "eventTime": "2018-04-17T21:39:52Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5d8492c3-4e71-4269-b4da-670752855687", "record_id": "flaws_cloudtrail:0000136:5d8492c3-4e71-4269-b4da-670752855687", "row_index": 136, "timestamp": "2018-04-17T21:39:52Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5d8492c3-4e71-4269-b4da-670752855687", "eventTime": "2018-04-17T21:39:52Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8df938a9-98b9-4750-b24d-fab42975314d", "record_id": "flaws_cloudtrail:0000137:8df938a9-98b9-4750-b24d-fab42975314d", "row_index": 137, "timestamp": "2018-04-17T21:39:52Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1170, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8df938a9-98b9-4750-b24d-fab42975314d", "eventTime": "2018-04-17T21:39:52Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "05060f1-f107-4598-b403-ffb26c9f899c", "record_id": "flaws_cloudtrail:0000138:05060f1-f107-4598-b403-ffb26c9f899c", "row_index": 138, "timestamp": "2018-04-17T21:39:53Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1837, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "05060f1-f107-4598-b403-ffb26c9f899c", "eventTime": "2018-04-17T21:39:53Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 42kPypTPCjsCU3Nde_Muj5zsqT3VsIo_lZuGXOzPx909-amsVFQ9vYS9PVdwqhpBFxvgmbqRWfwyWup2XlSRMOQIsqiQcABnZ96vU5ODISBGwra_guWdGU-u5TJfxnid28WkkyeRSNH2HnSwzM4mSRjJWUwMpQ__inr17wtVrY-jjpKbEXlXPfdlMI8BhpNw7GBzv75p_st9F98xKDnHSyfsLzv4p59yo5x2CJK2g_xBSqO_e9w6PihgpXiOj1yYt9wGYsTTL8YIGWlEhBCu53c5QYPkads0FObASmwQZ-eZdJp6GElYyYCja9H3swB0cJQ209iJa-mCZJEWMOyCBeuGgravNRBQh5sClpO1APcGovSWRXX1RbzIX3zknlvE6-f5OmedUaJjf2KVr_raN2csifqRgx_Nz7qWA1bZzGQOYoC92Rn0JPF-HwOWbN5Df8Pno0TLgZ49brWY9YWB0Xw_-nKGpbnDHllB7iCnZt4IK2DAyHH_A1wTL4PKlNElkby_dfgZl1C8MywSSousQQtlo-F0yMHRvpzpbCjdrUaF8aA0blB8tR9q6A9uFCg-pra2As5G9hs8ucG3FF1P05368rbCK06-k3kjoAhrfKUcgch3BJZm2EESrIujKNsKs7NSyYxJShTd9-JKELVMHSkpOTli0YQnhr1kwJ1P", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5a559c6a-7ecc-466b-8a7d-64a91536f256", "record_id": "flaws_cloudtrail:0000139:5a559c6a-7ecc-466b-8a7d-64a91536f256", "row_index": 139, "timestamp": "2018-04-17T21:39:53Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1174, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5a559c6a-7ecc-466b-8a7d-64a91536f256", "eventTime": "2018-04-17T21:39:53Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "79f490fc-3d44-4a0c-a172-bf0af397629af", "record_id": "flaws_cloudtrail:0000140:79f490fc-3d44-4a0c-a172-bf0af397629af", "row_index": 140, "timestamp": "2018-04-17T21:39:53Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "79f490fc-3d44-4a0c-a172-bf0af397629af", "eventTime": "2018-04-17T21:39:53Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aa9d553c-00ac-4e96-8f17-d67c66657b26", "record_id": "flaws_cloudtrail:0000141:aa9d553c-00ac-4e96-8f17-d67c66657b26", "row_index": 141, "timestamp": "2018-04-17T21:39:53Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aa9d553c-00ac-4e96-8f17-d67c66657b26", "eventTime": "2018-04-17T21:39:53Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "421881a2-3bf7-4954-b589-3d94e059700", "record_id": "flaws_cloudtrail:0000142:421881a2-3bf7-4954-b589-3d94e059700", "row_index": 142, "timestamp": "2018-04-17T21:39:54Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1837, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "421881a2-3bf7-4954-b589-3d94e059700", "eventTime": "2018-04-17T21:39:54Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: osAWLXcrKt4h0slVU_ztisfHNWm7tUt-cmfDlgFKpKxZ1peRDBRBL8c80Tt4Y_slL9kbJfwjBmT-6XrCOGYDJ1MExGLQl0Tuil1h4c3jgZUBYg19mPkCZCmtePRGYbDr4z0OYzXOgrFUYNtanf-jGRC_lmvLxHmXdHYq18eD27e722wZSqmcAAtskfGZOd5i3V7C3HbM0cUz2HcprJY-UWqhHkFS9RtlVYWgADucmOEisDHKOZ1-jNNEFusiT6KojggYDqlq1PHtRCjkgdOji5ac4himK3cUsA5KtJD7a_3X5qhait0TVZP9rK4aqI5EBWU7I5MKwOxDhFLhPBE99EpXt5DYznDdY2wYgbFhXWbsoiWrJ4ig8ogyLT4rq7fWChAgz-mTaW1SvSCRtSClSanONL7UOvCWNTA3J1HXBoezx3TGt7joG5-xA4AkIviMjzVTumHVs2swM4CIcihZJvc1mDwGxhDN0leycL_btH9uHpUONIm_2YMuwHGhpWTinITB3NCumb5DsqAFYOKcrn1nz837K3j-oh1sOWX2Lxt-Xydb-8-Rfn-nOwGCxhmYtElnMEYqvQ25crEtwd6Cgh-WH9wVFTPU0yHX4iVYtBGmWapPFj7LDs1ktzPkHfpCNS5tVUVQmeRYhUxZjKGZVvxia-U3jkDfSOkkoU16", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6b9da9b0-7b55-444b-9c83-3d5e52742", "record_id": "flaws_cloudtrail:0000143:6b9da9b0-7b55-444b-9c83-3d5e52742", "row_index": 143, "timestamp": "2018-04-17T21:39:54Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 811, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6b9da9b0-7b55-444b-9c83-3d5e52742", "eventTime": "2018-04-17T21:39:54Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1f15422b-403c-4111-a19d-1c0bbbaabe60", "record_id": "flaws_cloudtrail:0000144:1f15422b-403c-4111-a19d-1c0bbbaabe60", "row_index": 144, "timestamp": "2018-04-17T21:39:54Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1f15422b-403c-4111-a19d-1c0bbbaabe60", "eventTime": "2018-04-17T21:39:54Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d205c038-309d-4acd-9d19-d8be11c1cf5f", "record_id": "flaws_cloudtrail:0000145:d205c038-309d-4acd-9d19-d8be11c1cf5f", "row_index": 145, "timestamp": "2018-04-17T21:39:54Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d205c038-309d-4acd-9d19-d8be11c1cf5f", "eventTime": "2018-04-17T21:39:54Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "66376e4-4ea3-4cb7-8222-aa391091e", "record_id": "flaws_cloudtrail:0000146:66376e4-4ea3-4cb7-8222-aa391091e", "row_index": 146, "timestamp": "2018-04-17T21:39:54Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1167, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "66376e4-4ea3-4cb7-8222-aa391091e", "eventTime": "2018-04-17T21:39:54Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "619814e5f-1942-4e31-8b85-9ca3b60a034b", "record_id": "flaws_cloudtrail:0000147:619814e5f-1942-4e31-8b85-9ca3b60a034b", "row_index": 147, "timestamp": "2018-04-17T21:39:55Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 814, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "619814e5f-1942-4e31-8b85-9ca3b60a034b", "eventTime": "2018-04-17T21:39:55Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff5ae6f7-e50c-4f29-837d-893d1d3bb33d", "record_id": "flaws_cloudtrail:0000148:ff5ae6f7-e50c-4f29-837d-893d1d3bb33d", "row_index": 148, "timestamp": "2018-04-17T21:39:55Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff5ae6f7-e50c-4f29-837d-893d1d3bb33d", "eventTime": "2018-04-17T21:39:55Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8ebeec5c-7f05-4d80-9ee1-920be1c70ed8", "record_id": "flaws_cloudtrail:0000149:8ebeec5c-7f05-4d80-9ee1-920be1c70ed8", "row_index": 149, "timestamp": "2018-04-17T21:39:55Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1828, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8ebeec5c-7f05-4d80-9ee1-920be1c70ed8", "eventTime": "2018-04-17T21:39:55Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 060wgS-eDIJNYicTmT1mFZwS49ds-hGIIF3gruq_ZnApLv7GsOOYr_8K-Zf7uZdcpiWIT4qoO5X43gHCuInv7bY9Ml8o0_c62fr8SRjX8LEYh_xwHvwgK455XYXhhXev9X5OVbZ5IX9z4lxxI_IVponl6He-PJSUG7A0BBVeR-SjvLHreJBNEQbH5pvhuN7HyyE6ANSCc1brefXwnGOpp-NBD073jox49U3cXhL1HYDHYQw9Qxgvz0G6c5MF_CV-rUBjjt50lwtCVWpBz948SAKIFBIESJ78wT96b5EvfA3Al7pwBI3d2Bh_S8wwierpczZzrnFzwfJr3Hwuer38y1nXS7sP9Mi6VZ5_r_ahiJH9UPyhCSUteIOGFC-kJvr6cU5H-XuZLYK5rVpVusUqEDq8T9uC_q5fZa-CQdpNX0vUpp0dNoOxPF1_Cz4dIM7C5YdPYfZbPbdFtEx0ef1fGqFWn9OwyWKEg6Ly3wgDY4y3xhIqM6SUJhDhHynAFNUdv5tmd4QssigGz-EinWFpEEi7cpGSOgACiLPazvcm9aPo6HAxzWHHMDVIpFOpiSpMCsKCa99qVX6IZB3tu9YIOaeQI0Ct_Xlm-JBDJIQstBSU-1V4EProhP0SNPIarDRd8AdaOanFhk4_k5pm4aYSCVRWIrQ2KqhqCsw", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0c19b7db-98fd-4ff4-93da-8d763ab45447", "record_id": "flaws_cloudtrail:0000150:0c19b7db-98fd-4ff4-93da-8d763ab45447", "row_index": 150, "timestamp": "2018-04-17T21:39:56Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 814, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0c19b7db-98fd-4ff4-93da-8d763ab45447", "eventTime": "2018-04-17T21:39:56Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2b5aaf4d-8edf-4e2b-bea0-c749766caa", "record_id": "flaws_cloudtrail:0000151:2b5aaf4d-8edf-4e2b-bea0-c749766caa", "row_index": 151, "timestamp": "2018-04-17T21:39:56Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1275, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2b5aaf4d-8edf-4e2b-bea0-c749766caa", "eventTime": "2018-04-17T21:39:56Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c5171d3b-c4e8-462b-b496-28c902a6928b", "record_id": "flaws_cloudtrail:0000152:c5171d3b-c4e8-462b-b496-28c902a6928b", "row_index": 152, "timestamp": "2018-04-17T21:39:57Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c5171d3b-c4e8-462b-b496-28c902a6928b", "eventTime": "2018-04-17T21:39:57Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "71e6960f-8d65-4414-a4ab-a37c35fd9fa3", "record_id": "flaws_cloudtrail:0000153:71e6960f-8d65-4414-a4ab-a37c35fd9fa3", "row_index": 153, "timestamp": "2018-04-17T21:39:58Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "71e6960f-8d65-4414-a4ab-a37c35fd9fa3", "eventTime": "2018-04-17T21:39:58Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "890f40b6-791e-4005-9196-0ac0202bc808", "record_id": "flaws_cloudtrail:0000154:890f40b6-791e-4005-9196-0ac0202bc808", "row_index": 154, "timestamp": "2018-04-17T21:39:58Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "890f40b6-791e-4005-9196-0ac0202bc808", "eventTime": "2018-04-17T21:39:58Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f8090cb0-73b8-4630-95f3-a8407eed56ae", "record_id": "flaws_cloudtrail:0000155:f8090cb0-73b8-4630-95f3-a8407eed56ae", "row_index": 155, "timestamp": "2018-04-17T21:39:58Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f8090cb0-73b8-4630-95f3-a8407eed56ae", "eventTime": "2018-04-17T21:39:58Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "79b7bca3-6202-4d83-88f0-a12e7bf9199c", "record_id": "flaws_cloudtrail:0000156:79b7bca3-6202-4d83-88f0-a12e7bf9199c", "row_index": 156, "timestamp": "2018-04-17T21:39:58Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1827, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "79b7bca3-6202-4d83-88f0-a12e7bf9199c", "eventTime": "2018-04-17T21:39:58Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 8h819USVHXcSqaQVmzH1X2TTrxP6xYPw8sz5XNqiLnWJmBH66h299UmR-fI7oV0zMZUKMQoOrzoso29QQttr2u1mCfwcEezb4mBTKzsRNk4cBwIehmFhPv--gJLlUx_IXCqLiet6FtbCpFV5Mbh2xo4NILA0_p5VVcKir2WV6sVx0HlukH5eZVI2e6HAmcaUcyaVqa7l9Jkk6kTSDT9fqGddITgT69va9FlSmkv-HhrXmx02Z1f7ejNMmg-CCF2FWbMUGtbQ-xMn2g8BQ9UeaqSlwBYky5B6dZeqjk5fX5XYMWDMsEpUr2lsqCvjElDlp533kAStpgalg8nwe1qlp4gBYCI95dvfJkn8uEk3lhuciVp9IBRiyLwSEc-IaztHqxMqG3Y905Pg1LfA8Ze_tCFQJffuNGhCvXmEl04xs-9Om9OQVnhLyKXdZtqRSh-R6-LYi4SJ_oDtFWV8381sZM7YVOmiVmkEzPvN0p-1EpacZlHrRJGh0SRtOOxRJen_vipiWOhHOzF2eYTt99WqI7st85ZMNDwv6Pcj7A5YKzqieBSNafKQgsKX-A74mNMxlV4LKPT85BAg7P2TKYx_Vn3tgmvOnb-d1vcYBja3Z9J7rTLRqjQ4hgauE77nl2riTRjPcoKJyJKeyMV6cZlBPNY03mgg7wzBxA", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "004584ac-fd8b-461b-b4ea-00ae80bad11e", "record_id": "flaws_cloudtrail:0000157:004584ac-fd8b-461b-b4ea-00ae80bad11e", "row_index": 157, "timestamp": "2018-04-17T21:39:59Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "004584ac-fd8b-461b-b4ea-00ae80bad11e", "eventTime": "2018-04-17T21:39:59Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "60a69ad5-ea5a-4d3a-b29f-76bc532b91b2", "record_id": "flaws_cloudtrail:0000158:60a69ad5-ea5a-4d3a-b29f-76bc532b91b2", "row_index": 158, "timestamp": "2018-04-17T21:39:59Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "60a69ad5-ea5a-4d3a-b29f-76bc532b91b2", "eventTime": "2018-04-17T21:39:59Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "265a8020-c003-46b5-a2d2-873de4fb1fae", "record_id": "flaws_cloudtrail:0000159:265a8020-c003-46b5-a2d2-873de4fb1fae", "row_index": 159, "timestamp": "2018-04-17T21:39:59Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1170, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "265a8020-c003-46b5-a2d2-873de4fb1fae", "eventTime": "2018-04-17T21:39:59Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a2aa3d55-5bca-4989-97d2-d40c1bfcf478", "record_id": "flaws_cloudtrail:0000160:a2aa3d55-5bca-4989-97d2-d40c1bfcf478", "row_index": 160, "timestamp": "2018-04-17T21:39:59Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a2aa3d55-5bca-4989-97d2-d40c1bfcf478", "eventTime": "2018-04-17T21:39:59Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "de706bfb-c9fd-4b37-93fd-9494691898c7", "record_id": "flaws_cloudtrail:0000161:de706bfb-c9fd-4b37-93fd-9494691898c7", "row_index": 161, "timestamp": "2018-04-17T21:40:00Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "de706bfb-c9fd-4b37-93fd-9494691898c7", "eventTime": "2018-04-17T21:40:00Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "893a56b3-793a-46a6-8c03-6442bb55bb80", "record_id": "flaws_cloudtrail:0000162:893a56b3-793a-46a6-8c03-6442bb55bb80", "row_index": 162, "timestamp": "2018-04-17T21:40:00Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "893a56b3-793a-46a6-8c03-6442bb55bb80", "eventTime": "2018-04-17T21:40:00Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fa9856dc-d757-4079-9caa-3a765e233a94", "record_id": "flaws_cloudtrail:0000163:fa9856dc-d757-4079-9caa-3a765e233a94", "row_index": 163, "timestamp": "2018-04-17T21:40:00Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fa9856dc-d757-4079-9caa-3a765e233a94", "eventTime": "2018-04-17T21:40:00Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4baebe1e-d934-4573-a4bc-bdfc9165a770", "record_id": "flaws_cloudtrail:0000164:4baebe1e-d934-4573-a4bc-bdfc9165a770", "row_index": 164, "timestamp": "2018-04-17T21:40:00Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4baebe1e-d934-4573-a4bc-bdfc9165a770", "eventTime": "2018-04-17T21:40:00Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "15918de-7130-4ab3-9f24-035312f131f", "record_id": "flaws_cloudtrail:0000165:15918de-7130-4ab3-9f24-035312f131f", "row_index": 165, "timestamp": "2018-04-17T21:40:01Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "15918de-7130-4ab3-9f24-035312f131f", "eventTime": "2018-04-17T21:40:01Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d8e635c7-fc21-4ac3-85f2-26d6af273a51", "record_id": "flaws_cloudtrail:0000166:d8e635c7-fc21-4ac3-85f2-26d6af273a51", "row_index": 166, "timestamp": "2018-04-17T21:40:01Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d8e635c7-fc21-4ac3-85f2-26d6af273a51", "eventTime": "2018-04-17T21:40:01Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "48e9d5ad-5997-4ba3-ab8c-8fcfff9b6bac", "record_id": "flaws_cloudtrail:0000167:48e9d5ad-5997-4ba3-ab8c-8fcfff9b6bac", "row_index": 167, "timestamp": "2018-04-17T21:40:01Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "48e9d5ad-5997-4ba3-ab8c-8fcfff9b6bac", "eventTime": "2018-04-17T21:40:01Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1350eac6-fa73-432e-9fc6-fdaa29e079dd", "record_id": "flaws_cloudtrail:0000168:1350eac6-fa73-432e-9fc6-fdaa29e079dd", "row_index": 168, "timestamp": "2018-04-17T21:40:01Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1827, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1350eac6-fa73-432e-9fc6-fdaa29e079dd", "eventTime": "2018-04-17T21:40:01Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: DwoBUSTHcmA1R0Ttj2X2vNiQvDfsreQrxN-IN53A6e9aIKsQBBVfHF5Im2bqfZ_rL4wnAWIgRVyZN-cTA_9Bkt5DMMltjYyNt0hrnk84wWVfEZ0foqp7vdhPpe9Fs-lBqAb33ddqbpOyl4owAYSSvISg4ue-bmYrMQr0pDdA901lq0d2Ich4f7pIU352JUguKsf1vcdYOSAJCXaoICJOKlRRD-gsCfWeWYUb1_udtBRrprYxan4pk1CvwNKt3VuKaWZY1JFzyse3PEX8aZwiQQPFIcxCet8QHGTHDUgAXTuUX03eXPq0pfaTuuFjeHWmgyy_cEQAo3OBvTw8sYOQZB5cV0DjKbAKHVe6HuAenh2qzlpDZXWRW0A-RW6VEqVJ0Gg5qqWOHCGWk6HtDOAC-Gg19FIoBgrff3xPDSqC32U_9DYZyeSxjqTQRm9uLwY-hYgqmkt2Tb_nNhPQF8Ms1PuXl1UOKry17-6xAPsvMbNgzMER17TM7RopXXl9zPozggQGcTi5YSoHswiL_b6A1doJ02gNyohe-WssKpctp_OQ_53AlfsRLzFtzcgi2Viak5xnY1aY3xD8_UqjQZAYH_tgmM_tdUga5C6PHmmXEyQqFSVluyFXRo1xhanHfuGEbSA5slq2KA_RH69gamtzZDdPsDfbVioH4Q", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2488ba05-db68-4e3e-ad85-09d14611cf1", "record_id": "flaws_cloudtrail:0000169:2488ba05-db68-4e3e-ad85-09d14611cf1", "row_index": 169, "timestamp": "2018-04-17T21:40:02Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1175, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2488ba05-db68-4e3e-ad85-09d14611cf1", "eventTime": "2018-04-17T21:40:02Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cb60cc21-c0bc-41d0-b436-43093d8d832", "record_id": "flaws_cloudtrail:0000170:cb60cc21-c0bc-41d0-b436-43093d8d832", "row_index": 170, "timestamp": "2018-04-17T21:40:02Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1281, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cb60cc21-c0bc-41d0-b436-43093d8d832", "eventTime": "2018-04-17T21:40:02Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "db9f5e77-58fd-4f60-a2bc-bea1859709ab", "record_id": "flaws_cloudtrail:0000171:db9f5e77-58fd-4f60-a2bc-bea1859709ab", "row_index": 171, "timestamp": "2018-04-17T21:40:02Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1280, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "db9f5e77-58fd-4f60-a2bc-bea1859709ab", "eventTime": "2018-04-17T21:40:02Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b7e2a237-5ccd-42d0-b62b-7a570a3e907f", "record_id": "flaws_cloudtrail:0000172:b7e2a237-5ccd-42d0-b62b-7a570a3e907f", "row_index": 172, "timestamp": "2018-04-17T21:40:02Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b7e2a237-5ccd-42d0-b62b-7a570a3e907f", "eventTime": "2018-04-17T21:40:02Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8f8099b7-f031-498a-9778-9de2d6167f09", "record_id": "flaws_cloudtrail:0000173:8f8099b7-f031-498a-9778-9de2d6167f09", "row_index": 173, "timestamp": "2018-04-17T21:40:03Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1837, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8f8099b7-f031-498a-9778-9de2d6167f09", "eventTime": "2018-04-17T21:40:03Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: E0e8PPT9LOduBiIeTijez_W66Mpn6m_BmsXEi3tXFiGHrLZuhC6JuCOYU-eiXkU91NJ8cWlAFoKNA6eIrpaSpHZiDfvp8T2IiT6_kwfMd2SLJwABi4dr02qzaXwdMCxbM2LonRPfFYQ5ja4Dmgwm85UkkJ9vvCl6xXDyCa24QZCQloYF1SCRkVdeeGh8R1lkKMv8hI_5wnh5T254Se3JRTuwSvmWyu6ztOzsOchcFJCMbBpIh2e24dfXnVU9KCJ9sQ78I0xEdX854yak56ZcUdjAfBU3lAVaKpkLVDcNvY8RpE0T2618ZyR7jT_k3gSdlXqcB3js6Kz5o6b_ZAhoOVXMb1UcnlxZHiM_snjcbDk52XgD_0LmQLW93FT00-g8FIepaBQGsywMcz9lmYkulImlccum02D8qg8_9tMumEhUX1DtDqVolQE2e2_iivIvKB0Fo3bDtgN7rYSruj0cNtm9GNj7t7gqRS1czlASvgvCc10HfW-RX_tNY8EVQZQficjbpcIKw10Uv08ZkXgkP2HwkLBmirZo8GSbGo0TaCMp__ch1smSV0bQGM-G2AO14GHg4c_o8wYCl18T4utEjeKjAihDBk4F6mILe2NWT4eAtHYoloZ_x2rtTLgGsVX4r9ixpcoydolBRSVpvaFvp5wLc-_4s8AKsfLze_E", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "99d3b1d9-b4bb-4702-91c0-0bbad15d55da", "record_id": "flaws_cloudtrail:0000174:99d3b1d9-b4bb-4702-91c0-0bbad15d55da", "row_index": 174, "timestamp": "2018-04-17T21:40:03Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "99d3b1d9-b4bb-4702-91c0-0bbad15d55da", "eventTime": "2018-04-17T21:40:03Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "37838-951a-40f4-8d9b-b1e7fad353e4", "record_id": "flaws_cloudtrail:0000175:37838-951a-40f4-8d9b-b1e7fad353e4", "row_index": 175, "timestamp": "2018-04-17T21:40:03Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "37838-951a-40f4-8d9b-b1e7fad353e4", "eventTime": "2018-04-17T21:40:03Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f621ae20-4fb9-49cc-a064-0ffaa58e6631", "record_id": "flaws_cloudtrail:0000176:f621ae20-4fb9-49cc-a064-0ffaa58e6631", "row_index": 176, "timestamp": "2018-04-17T21:40:03Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f621ae20-4fb9-49cc-a064-0ffaa58e6631", "eventTime": "2018-04-17T21:40:03Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e78e2826-fc18-41ab-bd90-7a6aea09a724", "record_id": "flaws_cloudtrail:0000177:e78e2826-fc18-41ab-bd90-7a6aea09a724", "row_index": 177, "timestamp": "2018-04-17T21:40:04Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e78e2826-fc18-41ab-bd90-7a6aea09a724", "eventTime": "2018-04-17T21:40:04Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fbf13964-0d96-432b-985c-65a8c8b97779", "record_id": "flaws_cloudtrail:0000178:fbf13964-0d96-432b-985c-65a8c8b97779", "row_index": 178, "timestamp": "2018-04-17T21:40:04Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1283, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fbf13964-0d96-432b-985c-65a8c8b97779", "eventTime": "2018-04-17T21:40:04Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "62d3fa48-b8fd-4b04-9453-50eba5bab324", "record_id": "flaws_cloudtrail:0000179:62d3fa48-b8fd-4b04-9453-50eba5bab324", "row_index": 179, "timestamp": "2018-04-17T21:40:04Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "62d3fa48-b8fd-4b04-9453-50eba5bab324", "eventTime": "2018-04-17T21:40:04Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0816f817-68b4-43e1-89e0-7f6b25d42fb9", "record_id": "flaws_cloudtrail:0000180:0816f817-68b4-43e1-89e0-7f6b25d42fb9", "row_index": 180, "timestamp": "2018-04-17T21:40:05Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1174, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0816f817-68b4-43e1-89e0-7f6b25d42fb9", "eventTime": "2018-04-17T21:40:05Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "11bca885-29ed-4b8e-a3e5-8a276dd6ac9e", "record_id": "flaws_cloudtrail:0000181:11bca885-29ed-4b8e-a3e5-8a276dd6ac9e", "row_index": 181, "timestamp": "2018-04-17T21:40:05Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "11bca885-29ed-4b8e-a3e5-8a276dd6ac9e", "eventTime": "2018-04-17T21:40:05Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "462cc508-f154-4598-b96e-36c1a43dbd2e", "record_id": "flaws_cloudtrail:0000182:462cc508-f154-4598-b96e-36c1a43dbd2e", "row_index": 182, "timestamp": "2018-04-17T21:40:06Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1837, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "462cc508-f154-4598-b96e-36c1a43dbd2e", "eventTime": "2018-04-17T21:40:06Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 5dow3fNFEI7QVNRZvazB8cirRynC8WEuctS67rFOn-Oefq4Tv3c_GfPkOffB-Ylb4iyRQQoxNBCkiZ37hPiwe8uPpconZxhSygx8Z9kBr24wDSuARtRtyKtYt3nUZXGUhbkSNBCwx5ueCeta8S7vbBl6PPdcB-qOSnij9VqdUVFgM9p9Z7UL6RUa0KpoGCYxYcmSqDMpinghgMrO9gIGrB-8vPsk4d13y2-Kb5-INN5rN59ZK2frHyMcqyyXZajzeZ2Q7LhjHe7HCwdgWvVYEHLKZ4_j1ycdiO6l5GxBm93d03ouV9Zu7ExithY5SIwJyUXjR5-aEneN4r9Aof-F1ycFvF4_Wc_x8GdzDK4CJVdbrDWjPx-Xq3Cn1qlObFrJ6SsS_Hur_sbf-o4LdQ9lwc2pOjdC5Az-XOWswJTrscuKUrRqLOcCkoTZWX2I8XDUKdI-nxLtaQT94f5A2rFMdaD8VCnZqNvACbekupA97_gaaCUGJYXvOOGeFPfIwlN79Qx_EDOfK0FpitLoN0ZmgxB0Jivntt-YRA4O9oG0-3LGCLroC28urUJBD_0FqVyLnOOl7BsQfI4Qao1sTM2lUdV8bjXTQOyRaDsBuk9VS4a1V-lYdIB346GhijMUjeskmqGj9qQLNM8ftLThhCK8V-C1_DqWXBod7xR80Fo", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "51751-9164-4dfc-95ef-400d4ba5d251", "record_id": "flaws_cloudtrail:0000183:51751-9164-4dfc-95ef-400d4ba5d251", "row_index": 183, "timestamp": "2018-04-17T21:40:06Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1830, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "51751-9164-4dfc-95ef-400d4ba5d251", "eventTime": "2018-04-17T21:40:06Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: vQuudzvKoSAvcZKDXslK2YhYj35LlpoTKm8ROQOcQd1SKTcEF2YcjUhtqMcMmpruzfHerqRR8QqYOg2VCCDZpoGPu5c0Re3SBZkaoewaYVSwhXCt3Tt7AQmo_622nub4Tb1zWvuugshVonzZKrM3ojCytTkETiiCzVxYk3EUucu8kEx22c-Z3b31XwKUpnyPAt98w0ADpkp5A7pzXhRUBVSWcfONZUSkel3zkQmOePZOfSMq1H5Z2xuzruVgUC-eTTIe8-9SA1wZdNtD7_Pl2Uc8SKEvINctgBGlFXR0TxI5HAzSSkhbC0VdTdsj5j5M2ZVxtGJ2M4QOMr9So6QuHYJY5Nb2dvMW9lZYjgBAOAn8HqGVNOvFTciMk4viQt8gmHXWCghbk4mxsOyksVpSdF1PJEjtDSSk_o7T7ERyQVRfdJ9d2NEWD3o72x-rOsjKguQ6i3HOz_AaZ5LPNhzrlGnHCqbYSTD-wmjX7pKsNnNHcSh0y8dZF5c_8-zkp-eAlxGzpp0Ww2wHrfeW573ABiX-VzsqKmiyh7v-8NhE-dd36UZxNpQZ2a-PcCtzROlMa61FA5Y6ImKoYtLkWibvQ2wGHUWFahOdo6mFxi-h5435lvX15ffw4NANr4KsFDFYgRsjESyKNNL2gBOTgHuAUnMFRA2gMD9M037pcg", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "34c36681-4b70-4634-bc69-15e57478cf60", "record_id": "flaws_cloudtrail:0000184:34c36681-4b70-4634-bc69-15e57478cf60", "row_index": 184, "timestamp": "2018-04-17T21:40:06Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "34c36681-4b70-4634-bc69-15e57478cf60", "eventTime": "2018-04-17T21:40:06Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c8ef5ee7-0fea-41df-92ff-fb3a24d07b95", "record_id": "flaws_cloudtrail:0000185:c8ef5ee7-0fea-41df-92ff-fb3a24d07b95", "row_index": 185, "timestamp": "2018-04-17T21:40:06Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1276, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c8ef5ee7-0fea-41df-92ff-fb3a24d07b95", "eventTime": "2018-04-17T21:40:06Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3dffe9a6-2d10-4d0c-8253-dc7061e1bb0a", "record_id": "flaws_cloudtrail:0000186:3dffe9a6-2d10-4d0c-8253-dc7061e1bb0a", "row_index": 186, "timestamp": "2018-04-17T21:40:07Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 812, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3dffe9a6-2d10-4d0c-8253-dc7061e1bb0a", "eventTime": "2018-04-17T21:40:07Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c46ff88d-3d88-4d8f-b37f-955f88756e26", "record_id": "flaws_cloudtrail:0000187:c46ff88d-3d88-4d8f-b37f-955f88756e26", "row_index": 187, "timestamp": "2018-04-17T21:40:07Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c46ff88d-3d88-4d8f-b37f-955f88756e26", "eventTime": "2018-04-17T21:40:07Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "69fc7da0-969d-455b-a62d-f9230345fc63", "record_id": "flaws_cloudtrail:0000188:69fc7da0-969d-455b-a62d-f9230345fc63", "row_index": 188, "timestamp": "2018-04-17T21:40:07Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "69fc7da0-969d-455b-a62d-f9230345fc63", "eventTime": "2018-04-17T21:40:07Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e68413-9291-4f86-8739-ea9a6f016f5c", "record_id": "flaws_cloudtrail:0000189:e68413-9291-4f86-8739-ea9a6f016f5c", "row_index": 189, "timestamp": "2018-04-17T21:40:07Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1275, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e68413-9291-4f86-8739-ea9a6f016f5c", "eventTime": "2018-04-17T21:40:07Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0707b470-5fab-44da-ad88-1f04cf92ebb8", "record_id": "flaws_cloudtrail:0000190:0707b470-5fab-44da-ad88-1f04cf92ebb8", "row_index": 190, "timestamp": "2018-04-17T21:40:08Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0707b470-5fab-44da-ad88-1f04cf92ebb8", "eventTime": "2018-04-17T21:40:08Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "69d72c5f-bbab-4a85-9137-21d9f7049f9e", "record_id": "flaws_cloudtrail:0000191:69d72c5f-bbab-4a85-9137-21d9f7049f9e", "row_index": 191, "timestamp": "2018-04-17T21:40:08Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "69d72c5f-bbab-4a85-9137-21d9f7049f9e", "eventTime": "2018-04-17T21:40:08Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ba5a6249-30bd-4d58-96b2-204f15a5b3ec", "record_id": "flaws_cloudtrail:0000192:ba5a6249-30bd-4d58-96b2-204f15a5b3ec", "row_index": 192, "timestamp": "2018-04-17T21:40:09Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ba5a6249-30bd-4d58-96b2-204f15a5b3ec", "eventTime": "2018-04-17T21:40:09Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "275ab016-de03-43cc-8e34-0a7ae547e4c1", "record_id": "flaws_cloudtrail:0000193:275ab016-de03-43cc-8e34-0a7ae547e4c1", "row_index": 193, "timestamp": "2018-04-17T21:40:09Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1279, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "275ab016-de03-43cc-8e34-0a7ae547e4c1", "eventTime": "2018-04-17T21:40:09Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2deb4747-847a-4855-ac84-fb1f3af7ea94", "record_id": "flaws_cloudtrail:0000194:2deb4747-847a-4855-ac84-fb1f3af7ea94", "row_index": 194, "timestamp": "2018-04-17T21:40:10Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2deb4747-847a-4855-ac84-fb1f3af7ea94", "eventTime": "2018-04-17T21:40:10Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2c309113-2e4d-4a32-a856-1dbe626432f2", "record_id": "flaws_cloudtrail:0000195:2c309113-2e4d-4a32-a856-1dbe626432f2", "row_index": 195, "timestamp": "2018-04-17T21:40:10Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1828, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2c309113-2e4d-4a32-a856-1dbe626432f2", "eventTime": "2018-04-17T21:40:10Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: sCu_o42opK2wy6xDnDKtljucj_8OThFnQKV8xaSi1F8PsAhssQQfDSkg22fJBCz0j6wrBAhuKPMLo4SHnTQ2DLWVozRKK-7D-OVmylsfmDCHoZ56u7eM2f-fC-MVK0Xi3uDSEppxktVwa4V414K0DGACwfq8FrPkK5PuUSGcAnEmMtstu3ENlsrH4HO0-wejRXuC7UyH0mf784VNnwqXEa8c6WZzNzOdloYVNiFldxx4hDFZl3i_Lu3V-mVKOLWddO_4QDjkAmyVGaJCDA82H2AFnp6pTRVRkpwFAZoiIoJvWsF_J7hlvKl2e9pUmMIUOizTo7jsYwzqbzOOYG-QXmn_-XPzV-4dLljSeZUOAw1ezYqLJydUgGXKo01vQVwoAL7l5DmgdjpergD5cmYPIq8bOi_RMll1K9Ens8nnIxNX-qMwaDM6MjI0hrVxuLkqYIvgN-QtgGDFUzceC3Uen7bZYjbkQ6P8ijES0HyXdIzMefdhDSUqnrXrGVw-DE3qT9UxL99K-smC8lJn-5Zzy7yaMYjwyQtt15ud5uCB2wxlzORYH91d6BKvXVfYM5dSzurMQu-kqPuBGXSWz7vxsjV9xtXGyGKbxyw7oW8LPwvgBrgNFZx9RVmN_B3AVHy8r9V1FXqqkwzheFWbFIcx472OyZ4JcxKRef0", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3f090fc2-d849-4645-9f02-1f3c2b1b301b", "record_id": "flaws_cloudtrail:0000196:3f090fc2-d849-4645-9f02-1f3c2b1b301b", "row_index": 196, "timestamp": "2018-04-17T21:40:11Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3f090fc2-d849-4645-9f02-1f3c2b1b301b", "eventTime": "2018-04-17T21:40:11Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "494b6868-42c9-4002-868c-98bb1c59645b", "record_id": "flaws_cloudtrail:0000197:494b6868-42c9-4002-868c-98bb1c59645b", "row_index": 197, "timestamp": "2018-04-17T21:40:11Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "494b6868-42c9-4002-868c-98bb1c59645b", "eventTime": "2018-04-17T21:40:11Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6aac14c2-5fc0-47bc-bf28-4a16bb4ffeca", "record_id": "flaws_cloudtrail:0000198:6aac14c2-5fc0-47bc-bf28-4a16bb4ffeca", "row_index": 198, "timestamp": "2018-04-17T21:40:11Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6aac14c2-5fc0-47bc-bf28-4a16bb4ffeca", "eventTime": "2018-04-17T21:40:11Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "380c0837-5cde-49cb-9b72-5fa41d1cf163", "record_id": "flaws_cloudtrail:0000199:380c0837-5cde-49cb-9b72-5fa41d1cf163", "row_index": 199, "timestamp": "2018-04-17T21:40:11Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 807, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "380c0837-5cde-49cb-9b72-5fa41d1cf163", "eventTime": "2018-04-17T21:40:11Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "26489cc-dcf6-4882-a849-a798612d33c", "record_id": "flaws_cloudtrail:0000200:26489cc-dcf6-4882-a849-a798612d33c", "row_index": 200, "timestamp": "2018-04-17T21:40:11Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1275, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "26489cc-dcf6-4882-a849-a798612d33c", "eventTime": "2018-04-17T21:40:11Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4ec0f320-32d4-48d4-b3be-912d1e3fcf1a", "record_id": "flaws_cloudtrail:0000201:4ec0f320-32d4-48d4-b3be-912d1e3fcf1a", "row_index": 201, "timestamp": "2018-04-17T21:40:12Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4ec0f320-32d4-48d4-b3be-912d1e3fcf1a", "eventTime": "2018-04-17T21:40:12Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c51f4b10-f9f0-43f2-bff8-f1a81baf3f9b", "record_id": "flaws_cloudtrail:0000202:c51f4b10-f9f0-43f2-bff8-f1a81baf3f9b", "row_index": 202, "timestamp": "2018-04-17T21:40:12Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c51f4b10-f9f0-43f2-bff8-f1a81baf3f9b", "eventTime": "2018-04-17T21:40:12Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "13cbc1ca-024f-43c5-8af4-a126818ea4a92", "record_id": "flaws_cloudtrail:0000203:13cbc1ca-024f-43c5-8af4-a126818ea4a92", "row_index": 203, "timestamp": "2018-04-17T21:40:12Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1172, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "13cbc1ca-024f-43c5-8af4-a126818ea4a92", "eventTime": "2018-04-17T21:40:12Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf791d5c-3c98-40fa-bee1-aec0118b26a6", "record_id": "flaws_cloudtrail:0000204:bf791d5c-3c98-40fa-bee1-aec0118b26a6", "row_index": 204, "timestamp": "2018-04-17T21:40:13Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf791d5c-3c98-40fa-bee1-aec0118b26a6", "eventTime": "2018-04-17T21:40:13Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e4847d17-68a9-4d33-aa69-5f403fc977345", "record_id": "flaws_cloudtrail:0000205:e4847d17-68a9-4d33-aa69-5f403fc977345", "row_index": 205, "timestamp": "2018-04-17T21:40:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e4847d17-68a9-4d33-aa69-5f403fc977345", "eventTime": "2018-04-17T21:40:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7828d949-44e7-49aa-9a87-220929e52eb15", "record_id": "flaws_cloudtrail:0000206:7828d949-44e7-49aa-9a87-220929e52eb15", "row_index": 206, "timestamp": "2018-04-17T21:40:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7828d949-44e7-49aa-9a87-220929e52eb15", "eventTime": "2018-04-17T21:40:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f89b9692-6ecb-4fe9-8f10-e96f4f48ca34", "record_id": "flaws_cloudtrail:0000207:f89b9692-6ecb-4fe9-8f10-e96f4f48ca34", "row_index": 207, "timestamp": "2018-04-17T21:40:13Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1828, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f89b9692-6ecb-4fe9-8f10-e96f4f48ca34", "eventTime": "2018-04-17T21:40:13Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: EyI7dypNDqoTvBa4A-2YI44lRnhaNx9ulb7mlIT4wsvQMnueH-n2AXlJQi_q3d1Qcxqi5eU8tZiKexiQ-0ioioK7KzP7b80pIlCyXNM84KX6oNGyHwGQ7KrqkftxFKPuUhl7Ux-qE2Qmm4AIDagx-U8JSV0NNdMbu30_nDtFf_qjRLacIr_pR9a32js19ZCwp_hJ5YkUeF_u4p8QS5YpRnpVAfa5Pv5M5ZyqQSPV2SPz2uSWYg0NxIXgguSSFZWpPgi1shCM28CcslnaEUdQXjMbHGnPCWFkP0Ilg1DsV4Vf5UV0PmEbj2pgjPk4SIPNAh4AvtBFvhahgZl4dzdCDofldIofs8ve8qrIlnBTkWPimS1UADzT9ePKLLxdM49jBJzMCDGRq5pVUfc661UP3LVjrIOkUpNmx3rtAnylE9VR-_O8d9qyDix3AdQpch8NG-jJ2tefmPOOOAqBbO9Qj3Mjnz97axkogcDEUX5XrcvNlgeabi2_HFxIn2hiLxi1iw8lrosOsjThzYWu38TAyr-PeRLvnRPFPizYtEjcF5PssOcVebVngVTBMYhgUJNGIOECdVEViHMxqvTC7v-lRzkeoLGTQo-jZSRWlZ9KCFlcYrFDfzBYjII_uMM3Y-N1CerFuV0tKpryJRdnRfBblBE-bmi9B_XHQIs", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "68875e53-7289-4137-a25f-f66b833cb0a4", "record_id": "flaws_cloudtrail:0000208:68875e53-7289-4137-a25f-f66b833cb0a4", "row_index": 208, "timestamp": "2018-04-17T21:40:14Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "68875e53-7289-4137-a25f-f66b833cb0a4", "eventTime": "2018-04-17T21:40:14Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "20923c-5395-43c4-8792-d9614addcb86", "record_id": "flaws_cloudtrail:0000209:20923c-5395-43c4-8792-d9614addcb86", "row_index": 209, "timestamp": "2018-04-17T21:40:14Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1275, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "20923c-5395-43c4-8792-d9614addcb86", "eventTime": "2018-04-17T21:40:14Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d7d5141a-e6bc-4909-acab-459e501cffc5", "record_id": "flaws_cloudtrail:0000210:d7d5141a-e6bc-4909-acab-459e501cffc5", "row_index": 210, "timestamp": "2018-04-17T21:40:14Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d7d5141a-e6bc-4909-acab-459e501cffc5", "eventTime": "2018-04-17T21:40:14Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "63a88dcb-ce02-49b3-9e9c-420509719186", "record_id": "flaws_cloudtrail:0000211:63a88dcb-ce02-49b3-9e9c-420509719186", "row_index": 211, "timestamp": "2018-04-17T21:40:15Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1280, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "63a88dcb-ce02-49b3-9e9c-420509719186", "eventTime": "2018-04-17T21:40:15Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "55f1c7db-cc01-49e1-a311-af98e00e4299", "record_id": "flaws_cloudtrail:0000212:55f1c7db-cc01-49e1-a311-af98e00e4299", "row_index": 212, "timestamp": "2018-04-17T21:40:15Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "55f1c7db-cc01-49e1-a311-af98e00e4299", "eventTime": "2018-04-17T21:40:15Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fbd67859-a877-4966-a1b8-3ce8d62f6ee9", "record_id": "flaws_cloudtrail:0000213:fbd67859-a877-4966-a1b8-3ce8d62f6ee9", "row_index": 213, "timestamp": "2018-04-17T21:40:15Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fbd67859-a877-4966-a1b8-3ce8d62f6ee9", "eventTime": "2018-04-17T21:40:15Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8638fc30-63fa-4d40-8603-4d80ff92cf2c", "record_id": "flaws_cloudtrail:0000214:8638fc30-63fa-4d40-8603-4d80ff92cf2c", "row_index": 214, "timestamp": "2018-04-17T21:40:16Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1172, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8638fc30-63fa-4d40-8603-4d80ff92cf2c", "eventTime": "2018-04-17T21:40:16Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b8b087616-8b32-42ee-8b94-0b21c075f73a", "record_id": "flaws_cloudtrail:0000215:b8b087616-8b32-42ee-8b94-0b21c075f73a", "row_index": 215, "timestamp": "2018-04-17T21:40:16Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1281, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b8b087616-8b32-42ee-8b94-0b21c075f73a", "eventTime": "2018-04-17T21:40:16Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4c4f1155-16bd-49f2-8eb4-fc6a8719e409", "record_id": "flaws_cloudtrail:0000216:4c4f1155-16bd-49f2-8eb4-fc6a8719e409", "row_index": 216, "timestamp": "2018-04-17T21:40:16Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4c4f1155-16bd-49f2-8eb4-fc6a8719e409", "eventTime": "2018-04-17T21:40:16Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c53ad39e-9ce8-43af-8a26-6c0a301778b7f", "record_id": "flaws_cloudtrail:0000217:c53ad39e-9ce8-43af-8a26-6c0a301778b7f", "row_index": 217, "timestamp": "2018-04-17T21:40:16Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c53ad39e-9ce8-43af-8a26-6c0a301778b7f", "eventTime": "2018-04-17T21:40:16Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bd1d8dc2-5634-4073-a9e0-a8c25f916405c", "record_id": "flaws_cloudtrail:0000218:bd1d8dc2-5634-4073-a9e0-a8c25f916405c", "row_index": 218, "timestamp": "2018-04-17T21:40:17Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1175, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bd1d8dc2-5634-4073-a9e0-a8c25f916405c", "eventTime": "2018-04-17T21:40:17Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "37cc0650-634b-486b-8b10-9e70139e", "record_id": "flaws_cloudtrail:0000219:37cc0650-634b-486b-8b10-9e70139e", "row_index": 219, "timestamp": "2018-04-17T21:40:17Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1818, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "37cc0650-634b-486b-8b10-9e70139e", "eventTime": "2018-04-17T21:40:17Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: ynb5DDYMdR6QeB6QHPLcfHI13CDcTwjTNC2F94XmB4ffcR-QDhXCm84FZPeKzYAbr6d45LGA1n5W5xNWygLVVzexmDDB0dYwdLersMz8hnEZnTmqcCeAKoVnmMCEpmHQlCqogwvayFDoGhkhKcD-RgIY7xQXZUCr_jyNIb4rYL50oiHS4vxq5IvrqmAJ0AqX5v5EL7K4E3IGtDVbmZFTLTTVL1Z8PBcV0p2zx4xg9HY0XL3JHgYxr3eZk3VY5zRNoanNhjUlH5ESmCP8cLvBlupwUNW_mBwgJENvEWZtOOzA-_PsRrmgqU-4nKd6tmDf2J3HQ8r7wX5yCc4hy8eREx1Gb6OaYWbNk0Zk5ud62QxunoSM5AVuQ_N9museri4lWuKhmFmlODSw6IeugczbBLaHMUAdzy6vgeb-N1BkdCKRCcK-3V2cUVNbL06mN5MrCYJ3MMDSCRhaq4nAtd0TKJTWieaOl-pr5pfu_K3njaYo9L0aUNggo6Y3xAVzgHdIOVe-imRMN9rMgueb3-oKMbHAYiJWGYtlnScafaJppk9DDAbRJ8eHbX3NwzRbTxxTWzMfZYObXr1UypRR1SoM5cbC-cNLUVSKTg-fhzt6vwFZJOg2MThn7B-06WgtNSvzdfwJmrCC7dIntlPOlwaBnArJ7hVxqomPLw", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2ba754c2-3008-4529-a583-cadaa1bffbcf", "record_id": "flaws_cloudtrail:0000220:2ba754c2-3008-4529-a583-cadaa1bffbcf", "row_index": 220, "timestamp": "2018-04-17T21:40:17Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2ba754c2-3008-4529-a583-cadaa1bffbcf", "eventTime": "2018-04-17T21:40:17Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bc9830fc-ea43-4118-a204-98ae8ee1740c", "record_id": "flaws_cloudtrail:0000221:bc9830fc-ea43-4118-a204-98ae8ee1740c", "row_index": 221, "timestamp": "2018-04-17T21:40:18Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1830, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bc9830fc-ea43-4118-a204-98ae8ee1740c", "eventTime": "2018-04-17T21:40:18Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: gClzPNfd-zJrRIV4PN4RlFSmpdY1lAZktpYlpyObTyf53PS0uc5n-Fn1WxXGzb8xW82tP2xkeP-9DK5AkpXkYV9Zuaa1XYCmeQp7fFVhbJuRffVIxpcKUd5m5qTUXklV-tI27J1qVzjba1S2Xj_tK1TVJRcGayKP9zzu4ZUHgy4iUJcYmCGfyhjRWHYMgWwD-RivkntiLeli-gHxP--XbNpwhRzwXjEsxhBvBYcLDPBYU2p1SubfFl2RL5aUyFwysxMa5K_rNgL9L0SOLpsUH5hQPFVHkDwJohBjSoE4vrHTxeh_T8supS28hLhgIVw1sBNY8Rk2HcRF1OAphlZuoiTVVz70Ygri_17sbUypQ-kTPl54WJ1rPId3R841IfOmU6sbPhaupi6zdKYxzhNuc1BhpIwl9Rn7mba4asCsbjFk_EGnLnGcykgbNH6o7GtIuhC86GtDiSI4TSUMYV8yb1Q6a5VyknGMSwITxdPkP5Xqz8x06_y5pIQaRox33lVY6UpDwgMKl9eGWebhhcR5GlwmxbeNpEOv5V3UC82yLbV_GfBddoCWJvkmV5isoxTkC2vTWqiQTT0cKeWpZwg8RzLEYI380Qn-3_NgQ4tmp-am_0fszv36AezZ5B9h2K59F9-FDlqDWNRNJbzaltix2lAQCbTYkYDjAVJv", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "abeb65f2-3cf1-4c02-9e00-defe4a74a4bf", "record_id": "flaws_cloudtrail:0000222:abeb65f2-3cf1-4c02-9e00-defe4a74a4bf", "row_index": 222, "timestamp": "2018-04-17T21:40:18Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "abeb65f2-3cf1-4c02-9e00-defe4a74a4bf", "eventTime": "2018-04-17T21:40:18Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0f72750-dc64-43aa-be9d-f3f32f3114eb", "record_id": "flaws_cloudtrail:0000223:0f72750-dc64-43aa-be9d-f3f32f3114eb", "row_index": 223, "timestamp": "2018-04-17T21:40:18Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0f72750-dc64-43aa-be9d-f3f32f3114eb", "eventTime": "2018-04-17T21:40:18Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0263d5b9-f993-4f99-9132-c71809a791b5", "record_id": "flaws_cloudtrail:0000224:0263d5b9-f993-4f99-9132-c71809a791b5", "row_index": 224, "timestamp": "2018-04-17T21:40:19Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1833, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0263d5b9-f993-4f99-9132-c71809a791b5", "eventTime": "2018-04-17T21:40:19Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: TbPomBerc_9hzD6tMf-RJPZQWuYjNGwUvJAlquZhO88oXD7qzwBBxzzOJ6wjgooDrWdfxz2CVt_h13k7Bow2Sz8PipBO1-SkkxA-q2sVLXEs4jGjf-MTlJ1Lin6JD-GP1OqDJBwxmgr7JR195041lAqer_mYfZRrZ1OO7DZDDH05fdd84GcZ8BzT7o5fIky8yWo94lg2ToBZ78Na9YFLe2tGenwk4holC4e0Lo7WOkya6KMkWZUphFF5UJJoeXQl-BM1h7eV_d5tRRVajvK3Xg0TOU_DdnZQ8GUaHi4oQlDzX-943oS7OhHKiWqaIIWPviLrMnNgCLv_Rb3Be2Bcy24X31ST4vnLhn-372wRVZujjbGNE7HxUQB9qgV_XwUK2eYSN260QKSpg8yUcUZwtfD1NaphiTu9WPCXeiFeN-YHl2NG48t_dLgyz2EVXlbvcXbA88jitRSz_uoPr54osL1m2jHAtGHNiGeLq7CE8dTsSD9znWLASRW3jpoyTSV9uOtsi5GUB27y-eANQjbfTrJuIYeBctCWWevJsyOK28uVWbv-CLznjc4eY-VUMgKJGrHE_WSK48iCFJfEIRUT4pxZ64MtZO_KCdc90iN4cjRYWiSIr2Z1f7VGUv59N9DpE6qUTtl1LZQRGN7Pap_P-EqUb0JUBx5jGjp0e", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d44013f-13ea-41f9-9e74-baabeb6dfc73", "record_id": "flaws_cloudtrail:0000225:d44013f-13ea-41f9-9e74-baabeb6dfc73", "row_index": 225, "timestamp": "2018-04-17T21:40:19Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1276, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d44013f-13ea-41f9-9e74-baabeb6dfc73", "eventTime": "2018-04-17T21:40:19Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3a3d3975-ce7e-4828-8bd5-5e698d846a9a", "record_id": "flaws_cloudtrail:0000226:3a3d3975-ce7e-4828-8bd5-5e698d846a9a", "row_index": 226, "timestamp": "2018-04-17T21:40:20Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1171, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3a3d3975-ce7e-4828-8bd5-5e698d846a9a", "eventTime": "2018-04-17T21:40:20Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "131fa0d3-b4a8-4cff-ad81-cbbe3a84476", "record_id": "flaws_cloudtrail:0000227:131fa0d3-b4a8-4cff-ad81-cbbe3a84476", "row_index": 227, "timestamp": "2018-04-17T21:40:20Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "131fa0d3-b4a8-4cff-ad81-cbbe3a84476", "eventTime": "2018-04-17T21:40:20Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "47d159dd-0247-47f5-bffd-ff9ecf15d48b", "record_id": "flaws_cloudtrail:0000228:47d159dd-0247-47f5-bffd-ff9ecf15d48b", "row_index": 228, "timestamp": "2018-04-17T21:40:21Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "47d159dd-0247-47f5-bffd-ff9ecf15d48b", "eventTime": "2018-04-17T21:40:21Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "54d179e6-1d5d-4c47-8182-fae9693f5457", "record_id": "flaws_cloudtrail:0000229:54d179e6-1d5d-4c47-8182-fae9693f5457", "row_index": 229, "timestamp": "2018-04-17T21:40:22Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1827, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "54d179e6-1d5d-4c47-8182-fae9693f5457", "eventTime": "2018-04-17T21:40:22Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: FJHdlHmafig_kNJh4_eKriXipcF_QPbjW47pOlZ5TP8EKFQaIOih6Ndwkcr8yyL7N36lSI5eDlYaSX4oTcmdO5Toavs-F7_2tYB-jKT1J7iIpDeOJ8O9y2NQ7_ffJ5PkfgfOXHruPwwcmX4SVi_-b2ZXGNNNATPqe8i84XOlhZOGqbT2UVKF84C7r1VNQfivhCQidEJgyHqCLfEja3ihKnvFmE8IAVCeRl1uTz0cu775kNQeM5XsmFfwNBzej_vx5rW1pPWw6ZDl7wImoQRXnz1oh00OzWgqTdPBpZlnwLFF6ieaHtKY1MKvrfV5mXF-_fSWLkzH1Odr81_QUnr23MAKPakcsuDWokAkvHnU9EmML0IdQdD613_NuT5zg4lLGIFAoOavRbijHS3aZuvJXPZ2uJSB3AwVKUaQi-xZExU_HnufWW_J-QISXp16FwDeNuZdhtPvBDLl5eTt9PFizGIZvOThQcxTeWMp56YPhyVRCQ9zmHvY8NcoOSfdEyL6QdK3KMbVaiGDFsioJWCun-9yWeociX2_4JU9zQkwUI5GuJhhVl0aqYSBKyNXD7cP29GbaYZVsPU4477dE0IYb5kQD8KuYZmsd4X5BTMOCLVwuEK_YUCCN5ZFG15_L0AD7JfE4FXosHuH0yHG8bc9u3LTOx8C5DJcrg", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e89cbe91-eb82-41fd-9d57-24f5c597edea", "record_id": "flaws_cloudtrail:0000230:e89cbe91-eb82-41fd-9d57-24f5c597edea", "row_index": 230, "timestamp": "2018-04-17T21:40:22Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e89cbe91-eb82-41fd-9d57-24f5c597edea", "eventTime": "2018-04-17T21:40:22Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "42c329a4-235e-4ad2-996e-fbb3d0040178", "record_id": "flaws_cloudtrail:0000231:42c329a4-235e-4ad2-996e-fbb3d0040178", "row_index": 231, "timestamp": "2018-04-17T21:40:24Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "42c329a4-235e-4ad2-996e-fbb3d0040178", "eventTime": "2018-04-17T21:40:24Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "32bcca83-0dab-4707-a423-a956c20735c6", "record_id": "flaws_cloudtrail:0000232:32bcca83-0dab-4707-a423-a956c20735c6", "row_index": 232, "timestamp": "2018-04-17T21:40:25Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1171, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "32bcca83-0dab-4707-a423-a956c20735c6", "eventTime": "2018-04-17T21:40:25Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6b69aaf6-dd80-40b3-8b80-148ecd8fed19", "record_id": "flaws_cloudtrail:0000233:6b69aaf6-dd80-40b3-8b80-148ecd8fed19", "row_index": 233, "timestamp": "2018-04-17T21:40:26Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1828, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6b69aaf6-dd80-40b3-8b80-148ecd8fed19", "eventTime": "2018-04-17T21:40:26Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: eyY2sL8deIvA8DX1kFF0ZA6WyUrUAhGQxDMFIyo8InQlLxdx7jvtq2KhwoKh7H2iZyp6WZCopK75qEWvx-OxGj2dPECQ8ACwOx8WqXl-tPHiMmPzUZGmboYuIdLJum5SYULOfMQXZExeiSOI1OAP7zgeJIMWbCpr4cOAH2iZ6HtvlKCOhhn76geGjtIQyXBUP_Q8wBbBhBuwQcMTz5jePf0uDzdwiz7emtNFZklm715jigjYZW9jY8u9co568GzoENWp5WNXJOqmpqhCXB9yCRb9HiX8NwRPy1n_wJUtZIH-qrZ3t_1qElFZ5UnDsQFVBjJVe8D5xKmNLYZtnhlDMeZ2cCAuc5lD5kgvuKVf6eoliqU98NaiW1xVmGoA90h7RtSL3KLqjfyHfWAHbFuba3ntZl6EfkPevGSHGI9LgXZfq9ENTumDQODEqer4UDBZgOIEogCY7jQKfH2bIaTkZY5gBwCKzN66DdHL9A7JkDcf1DXM6EGWyD-IcsTTbckY1gQiDFJo9iWcH9Lg0CV9nbQMXaylSqI832-a9sH_rFeRaZUNgzuLHvu1qoSnqmJrUkR_Gd0sym5NCe3WexvrEfMYAoqR0ygGHBTuqdHTCtub4BVd6euT_U10ludCkE4y2e1P5vT9lu19Z5oTMH-nDM8ANETKTRqF4dY", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "679f16c3-8e21-4d12-960f-5f46cee16b12", "record_id": "flaws_cloudtrail:0000234:679f16c3-8e21-4d12-960f-5f46cee16b12", "row_index": 234, "timestamp": "2018-04-17T21:42:05Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA4Q57W554H9QCHYEE", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "52.112.191.17", "user_agent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/data-reader-43"], "raw_record_size_bytes": 679, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "679f16c3-8e21-4d12-960f-5f46cee16b12", "eventTime": "2018-04-17T21:42:05Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "52.112.191.17", "userAgent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA4Q57W554H9QCHYEE", "userName": "backup"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/data-reader-43", "roleSessionName": "reader-4947"}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/data-reader-43"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "da3d43e2-b5f4-4cbe-b11b-b764d5184650", "record_id": "flaws_cloudtrail:0000235:da3d43e2-b5f4-4cbe-b11b-b764d5184650", "row_index": 235, "timestamp": "2018-04-17T21:43:21Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA4Q57W554H9QCHYEE", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "52.112.191.17", "user_agent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 497, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "da3d43e2-b5f4-4cbe-b11b-b764d5184650", "eventTime": "2018-04-17T21:43:21Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "52.112.191.17", "userAgent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA4Q57W554H9QCHYEE", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "67bd399c-d430-4196-8456-39ceac4c2739", "record_id": "flaws_cloudtrail:0000236:67bd399c-d430-4196-8456-39ceac4c2739", "row_index": 236, "timestamp": "2018-04-17T21:45:21Z", "event_type": "GetBucketAcl", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA4Q57W554H9QCHYEE", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "52.112.191.17", "user_agent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:s3:::prod-data-3674"], "raw_record_size_bytes": 602, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "67bd399c-d430-4196-8456-39ceac4c2739", "eventTime": "2018-04-17T21:45:21Z", "eventName": "GetBucketAcl", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "52.112.191.17", "userAgent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA4Q57W554H9QCHYEE", "userName": "backup"}, "requestParameters": {"bucketName": "prod-data-3674"}, "resources": [{"ARN": "arn:aws:s3:::prod-data-3674"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "131b7045-2b64-4057-91a1-73b17907cf2e", "record_id": "flaws_cloudtrail:0000237:131b7045-2b64-4057-91a1-73b17907cf2e", "row_index": 237, "timestamp": "2018-04-17T21:46:39Z", "event_type": "GetBucketAcl", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA4Q57W554H9QCHYEE", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "52.112.191.17", "user_agent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:s3:::prod-data-3674-archive"], "raw_record_size_bytes": 618, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "131b7045-2b64-4057-91a1-73b17907cf2e", "eventTime": "2018-04-17T21:46:39Z", "eventName": "GetBucketAcl", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "52.112.191.17", "userAgent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA4Q57W554H9QCHYEE", "userName": "backup"}, "requestParameters": {"bucketName": "prod-data-3674-archive"}, "resources": [{"ARN": "arn:aws:s3:::prod-data-3674-archive"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "028b8842-7fb7-44aa-a4bf-53fe932bc0c9", "record_id": "flaws_cloudtrail:0000238:028b8842-7fb7-44aa-a4bf-53fe932bc0c9", "row_index": 238, "timestamp": "2018-04-17T21:49:07Z", "event_type": "ListObjects", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA4Q57W554H9QCHYEE", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "52.112.191.17", "user_agent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:s3:::prod-data-3674"], "raw_record_size_bytes": 622, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "028b8842-7fb7-44aa-a4bf-53fe932bc0c9", "eventTime": "2018-04-17T21:49:07Z", "eventName": "ListObjects", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "52.112.191.17", "userAgent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA4Q57W554H9QCHYEE", "userName": "backup"}, "requestParameters": {"bucketName": "prod-data-3674", "prefix": "customer/"}, "resources": [{"ARN": "arn:aws:s3:::prod-data-3674"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4048b643-ca83-472c-b985-634ae9beec13", "record_id": "flaws_cloudtrail:0000239:4048b643-ca83-472c-b985-634ae9beec13", "row_index": 239, "timestamp": "2018-04-17T21:51:23Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 775, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4048b643-ca83-472c-b985-634ae9beec13", "eventTime": "2018-04-17T21:51:23Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fe29680f-7483-47f6-a98f-7e2906730a39", "record_id": "flaws_cloudtrail:0000240:fe29680f-7483-47f6-a98f-7e2906730a39", "row_index": 240, "timestamp": "2018-04-17T21:51:24Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 814, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fe29680f-7483-47f6-a98f-7e2906730a39", "eventTime": "2018-04-17T21:51:24Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "17f3a3b4-d8a2-49eb-9a5f-3ae32307bf2c", "record_id": "flaws_cloudtrail:0000241:17f3a3b4-d8a2-49eb-9a5f-3ae32307bf2c", "row_index": 241, "timestamp": "2018-04-17T21:51:24Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 814, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "17f3a3b4-d8a2-49eb-9a5f-3ae32307bf2c", "eventTime": "2018-04-17T21:51:24Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4dd6d1d8-0b6c-4d8d-8c85-ed646127a4dc9", "record_id": "flaws_cloudtrail:0000242:4dd6d1d8-0b6c-4d8d-8c85-ed646127a4dc9", "row_index": 242, "timestamp": "2018-04-17T21:51:24Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4dd6d1d8-0b6c-4d8d-8c85-ed646127a4dc9", "eventTime": "2018-04-17T21:51:24Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "44721f7-b3b2-457f-a5d3-6bb5fb20b546", "record_id": "flaws_cloudtrail:0000243:44721f7-b3b2-457f-a5d3-6bb5fb20b546", "row_index": 243, "timestamp": "2018-04-17T21:51:25Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "44721f7-b3b2-457f-a5d3-6bb5fb20b546", "eventTime": "2018-04-17T21:51:25Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d94ca773-ee9a-4369-83b8-a86c35aa5864", "record_id": "flaws_cloudtrail:0000244:d94ca773-ee9a-4369-83b8-a86c35aa5864", "row_index": 244, "timestamp": "2018-04-17T21:51:25Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d94ca773-ee9a-4369-83b8-a86c35aa5864", "eventTime": "2018-04-17T21:51:25Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b48cef1a-d3f2-4a69-9045-9536c6f9427f", "record_id": "flaws_cloudtrail:0000245:b48cef1a-d3f2-4a69-9045-9536c6f9427f", "row_index": 245, "timestamp": "2018-04-17T21:51:25Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b48cef1a-d3f2-4a69-9045-9536c6f9427f", "eventTime": "2018-04-17T21:51:25Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0a49bfe3-2654-4206-94da-71e2e59cb5ae", "record_id": "flaws_cloudtrail:0000246:0a49bfe3-2654-4206-94da-71e2e59cb5ae", "row_index": 246, "timestamp": "2018-04-17T21:51:25Z", "event_type": "GetObject", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA4Q57W554H9QCHYEE", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "52.112.191.17", "user_agent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:s3:::prod-data-3674"], "raw_record_size_bytes": 627, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0a49bfe3-2654-4206-94da-71e2e59cb5ae", "eventTime": "2018-04-17T21:51:25Z", "eventName": "GetObject", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "52.112.191.17", "userAgent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA4Q57W554H9QCHYEE", "userName": "backup"}, "requestParameters": {"bucketName": "prod-data-3674", "key": "customer/02097.json"}, "resources": [{"ARN": "arn:aws:s3:::prod-data-3674"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ed10ef40-35c2-4b05-bef9-77bce90cf762", "record_id": "flaws_cloudtrail:0000247:ed10ef40-35c2-4b05-bef9-77bce90cf762", "row_index": 247, "timestamp": "2018-04-17T21:51:28Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ed10ef40-35c2-4b05-bef9-77bce90cf762", "eventTime": "2018-04-17T21:51:28Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "031b3eb1-e39b-4773-b270-f4f82befe5e2", "record_id": "flaws_cloudtrail:0000248:031b3eb1-e39b-4773-b270-f4f82befe5e2", "row_index": 248, "timestamp": "2018-04-17T21:51:28Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "031b3eb1-e39b-4773-b270-f4f82befe5e2", "eventTime": "2018-04-17T21:51:28Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "43879-a9ec-492d-b37a-a9d9f242d61c", "record_id": "flaws_cloudtrail:0000249:43879-a9ec-492d-b37a-a9d9f242d61c", "row_index": 249, "timestamp": "2018-04-17T21:51:28Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "43879-a9ec-492d-b37a-a9d9f242d61c", "eventTime": "2018-04-17T21:51:28Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "943fe5a1-95df-4d68-805b-34ba2ae7adaa", "record_id": "flaws_cloudtrail:0000250:943fe5a1-95df-4d68-805b-34ba2ae7adaa", "row_index": 250, "timestamp": "2018-04-17T21:51:28Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "943fe5a1-95df-4d68-805b-34ba2ae7adaa", "eventTime": "2018-04-17T21:51:28Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3ec5f2f9-b552-4dea-9d8a-9a1e70b1989f", "record_id": "flaws_cloudtrail:0000251:3ec5f2f9-b552-4dea-9d8a-9a1e70b1989f", "row_index": 251, "timestamp": "2018-04-17T21:51:28Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3ec5f2f9-b552-4dea-9d8a-9a1e70b1989f", "eventTime": "2018-04-17T21:51:28Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "db070b09-f680-42b5-809a-65fa8e2a959b", "record_id": "flaws_cloudtrail:0000252:db070b09-f680-42b5-809a-65fa8e2a959b", "row_index": 252, "timestamp": "2018-04-17T21:51:28Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "db070b09-f680-42b5-809a-65fa8e2a959b", "eventTime": "2018-04-17T21:51:28Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c96021-42f0-4424-9017-204d9ddafd74", "record_id": "flaws_cloudtrail:0000253:c96021-42f0-4424-9017-204d9ddafd74", "row_index": 253, "timestamp": "2018-04-17T21:51:29Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1280, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c96021-42f0-4424-9017-204d9ddafd74", "eventTime": "2018-04-17T21:51:29Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4e140694-d52f-4ee5-a6fc-b54c3987856e", "record_id": "flaws_cloudtrail:0000254:4e140694-d52f-4ee5-a6fc-b54c3987856e", "row_index": 254, "timestamp": "2018-04-17T21:51:29Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4e140694-d52f-4ee5-a6fc-b54c3987856e", "eventTime": "2018-04-17T21:51:29Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a6fded32-ffc5-432f-8045-6ff3e162f1ea", "record_id": "flaws_cloudtrail:0000255:a6fded32-ffc5-432f-8045-6ff3e162f1ea", "row_index": 255, "timestamp": "2018-04-17T21:51:29Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1280, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a6fded32-ffc5-432f-8045-6ff3e162f1ea", "eventTime": "2018-04-17T21:51:29Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "645f7fd6-91e0-41ea-830c-a68401b69254", "record_id": "flaws_cloudtrail:0000256:645f7fd6-91e0-41ea-830c-a68401b69254", "row_index": 256, "timestamp": "2018-04-17T21:51:29Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "645f7fd6-91e0-41ea-830c-a68401b69254", "eventTime": "2018-04-17T21:51:29Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ae7640f2-3876-48bc-87ae-bc6572e0c3ac", "record_id": "flaws_cloudtrail:0000257:ae7640f2-3876-48bc-87ae-bc6572e0c3ac", "row_index": 257, "timestamp": "2018-04-17T21:51:29Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ae7640f2-3876-48bc-87ae-bc6572e0c3ac", "eventTime": "2018-04-17T21:51:29Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7d069bf3-8ec3-4c27-a940-eb58953d14", "record_id": "flaws_cloudtrail:0000258:7d069bf3-8ec3-4c27-a940-eb58953d14", "row_index": 258, "timestamp": "2018-04-17T21:51:30Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1281, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7d069bf3-8ec3-4c27-a940-eb58953d14", "eventTime": "2018-04-17T21:51:30Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "765e89fd-b6bd-410d-9a70-0a29916d1a6", "record_id": "flaws_cloudtrail:0000259:765e89fd-b6bd-410d-9a70-0a29916d1a6", "row_index": 259, "timestamp": "2018-04-17T21:51:30Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1281, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "765e89fd-b6bd-410d-9a70-0a29916d1a6", "eventTime": "2018-04-17T21:51:30Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4ff84c1c-95a3-43a9-8e0c-0f35985131e5", "record_id": "flaws_cloudtrail:0000260:4ff84c1c-95a3-43a9-8e0c-0f35985131e5", "row_index": 260, "timestamp": "2018-04-17T21:51:30Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4ff84c1c-95a3-43a9-8e0c-0f35985131e5", "eventTime": "2018-04-17T21:51:30Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3c5c1c32-1840-494f-a526-ca468ed8132d", "record_id": "flaws_cloudtrail:0000261:3c5c1c32-1840-494f-a526-ca468ed8132d", "row_index": 261, "timestamp": "2018-04-17T21:51:30Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3c5c1c32-1840-494f-a526-ca468ed8132d", "eventTime": "2018-04-17T21:51:30Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "835474-1710-4738-9847-1ef330156e081", "record_id": "flaws_cloudtrail:0000262:835474-1710-4738-9847-1ef330156e081", "row_index": 262, "timestamp": "2018-04-17T21:51:30Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "835474-1710-4738-9847-1ef330156e081", "eventTime": "2018-04-17T21:51:30Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "47aa41f2-5068-4a38-941d-d172787df371", "record_id": "flaws_cloudtrail:0000263:47aa41f2-5068-4a38-941d-d172787df371", "row_index": 263, "timestamp": "2018-04-17T21:51:30Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "47aa41f2-5068-4a38-941d-d172787df371", "eventTime": "2018-04-17T21:51:30Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8a24a34b-57c3-443a-b335-66c5d09e949e", "record_id": "flaws_cloudtrail:0000264:8a24a34b-57c3-443a-b335-66c5d09e949e", "row_index": 264, "timestamp": "2018-04-17T21:51:31Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1838, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8a24a34b-57c3-443a-b335-66c5d09e949e", "eventTime": "2018-04-17T21:51:31Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: n9cNC5bMUgEFngjGifa-2BTUsJ64fYL9MXxWfC7U4YtEQ0h5SiXHKbOX8Wl-thKsxWwhkUVRgive_EZk-_bkvbHiyX1I5kBRVizmQjcuvC3QdLXUsdjtseav1JCh1T9aiUilxfGDz82ZqV2QcbfPFdRHTUOkQZdJvoHlm7QQ08AaDU5O8lEw5pY6RIEQRfk8Kvflf8dp-_Nq1wOiomddje8TGfTgJiDuaNLgRYtrosa5pNeBHspJetOMYtQLxIF9jjuCTnZxMx8W4dlR5-ClYeTz1yYB4Dr3ihZprgmHdNVYPJMgLP5glKnAfell7ALHujG-PZJ5Yf0so4qAE_rba-PuCEOnQrmBYMyqhLMOgnC7lcscDuw-OKdy0YDXgnwnIEJH2c5wIq3RntvdNiahM3SnJf0Hz9l9fQMKu4fMAqxDGCL1M0OM921OWR7i_XJCGOtSU2aVFcpxK0hE5OhfsRG5p3LJWLimzPjqbC4lj82CWx2Nq3GEvGYNzjVunmkm-S2fJMcM1_QsuK0JIvrnmUSPgtNReS5GcAfsTv0Uy0WPcwwBeAXx9M5qm9dOaK4eutRZxARxogPzv4GrYtu5RdEaLePUm0JnLS_kjRUcAuxGx33BFN3cG6tTeB3P5TiQMvGBEqNV8jAo6PDXkQqNYBN8YewBaW4H3e4w27sN", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "494a3cc0-7888-42ea-b205-fa755a48c1ef", "record_id": "flaws_cloudtrail:0000265:494a3cc0-7888-42ea-b205-fa755a48c1ef", "row_index": 265, "timestamp": "2018-04-17T21:51:31Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1176, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "494a3cc0-7888-42ea-b205-fa755a48c1ef", "eventTime": "2018-04-17T21:51:31Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "097874f35-cea1-43c9-9fbd-f03457ce2e4b", "record_id": "flaws_cloudtrail:0000266:097874f35-cea1-43c9-9fbd-f03457ce2e4b", "row_index": 266, "timestamp": "2018-04-17T21:51:31Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "097874f35-cea1-43c9-9fbd-f03457ce2e4b", "eventTime": "2018-04-17T21:51:31Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fb6c4056-307f-4583-af79-7b0129e859b5", "record_id": "flaws_cloudtrail:0000267:fb6c4056-307f-4583-af79-7b0129e859b5", "row_index": 267, "timestamp": "2018-04-17T21:51:31Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fb6c4056-307f-4583-af79-7b0129e859b5", "eventTime": "2018-04-17T21:51:31Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1ad6b7cf-93c2-466c-9bda-bfeca1e68fc6", "record_id": "flaws_cloudtrail:0000268:1ad6b7cf-93c2-466c-9bda-bfeca1e68fc6", "row_index": 268, "timestamp": "2018-04-17T21:51:31Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1170, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1ad6b7cf-93c2-466c-9bda-bfeca1e68fc6", "eventTime": "2018-04-17T21:51:31Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "03ab6bb4-7c6c-464e-9ed3-fcc66dc2ec82", "record_id": "flaws_cloudtrail:0000269:03ab6bb4-7c6c-464e-9ed3-fcc66dc2ec82", "row_index": 269, "timestamp": "2018-04-17T21:51:32Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1838, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "03ab6bb4-7c6c-464e-9ed3-fcc66dc2ec82", "eventTime": "2018-04-17T21:51:32Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: KUulZzznvLBQUaKMCNtmXVkznTkGhuvnB5Ky_qSi5WJ7jgMdVYht1FxK8dGlMu-NzE2XmquIemPMmSUkD7b4JzeZaihtzOBvkVwa8jljDBU2b84G64XEb7k-Q-mjzMQ3I2PQL0RskGNAj5rVqoMTUMDzZnCD8vBkJnIXNZn8MdhFbAx2h3vbX6UmPa36NYFfmRyI_SfLPmTP7-ewG93lixNipHHBAYm0XGFO649wkeG6vv-6KFyMM9Df3PF2VFQPZiaFSZ7K4l71sMTA7ZyemKlaYiwvCArFyrt6WSvcURbnYK0QbW2p3ws8JsRW0bRLq3q7aKj78U84n24ZuOrdkRi2X7nxIbJeK0QnrhtWRoJMVrz9JoTMTnrowgFaHlWLIm_Mux3SihbJm2c2AVvFUz2ZXUqZqS7eyOED1I5lVctI-FSsLZVWneAbm9MPRnsLznQmZ6-9GOCWxGOvbBplsFC3J65fOz-FEawt4uqyTVvIT3Vl97Ay8kBHQAqji6vbWeCjWyzurP1jgJ7QQ91oeIfCjSZPGuxnc8Ev1krMNY6njrORhRpGZXWidpfuYYYYLiMo9g59X05iMhUb8JOwIgIhnB3DtZ35ectPwfaiwyEC8jMs2k3Hhcl88coj1xezH7k5ljMCj6AgUXJqkEVaNDaIMkx17dYUatkpY52o", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "24af55be-6b02-449e-8881-fa9f3ea224a8", "record_id": "flaws_cloudtrail:0000270:24af55be-6b02-449e-8881-fa9f3ea224a8", "row_index": 270, "timestamp": "2018-04-17T21:51:32Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 814, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "24af55be-6b02-449e-8881-fa9f3ea224a8", "eventTime": "2018-04-17T21:51:32Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "87ea846a-c41f-4189-bae4-7bf595001", "record_id": "flaws_cloudtrail:0000271:87ea846a-c41f-4189-bae4-7bf595001", "row_index": 271, "timestamp": "2018-04-17T21:51:32Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "87ea846a-c41f-4189-bae4-7bf595001", "eventTime": "2018-04-17T21:51:32Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "66d2f3c1-a275-4db8-90c8-298cf399576ad", "record_id": "flaws_cloudtrail:0000272:66d2f3c1-a275-4db8-90c8-298cf399576ad", "row_index": 272, "timestamp": "2018-04-17T21:51:32Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "66d2f3c1-a275-4db8-90c8-298cf399576ad", "eventTime": "2018-04-17T21:51:32Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "458d3a32-0463-480a-9341-2ac435f99731", "record_id": "flaws_cloudtrail:0000273:458d3a32-0463-480a-9341-2ac435f99731", "row_index": 273, "timestamp": "2018-04-17T21:51:32Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "458d3a32-0463-480a-9341-2ac435f99731", "eventTime": "2018-04-17T21:51:32Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b4709b59-bcae-46bf-b08a-f73a9470cd7a", "record_id": "flaws_cloudtrail:0000274:b4709b59-bcae-46bf-b08a-f73a9470cd7a", "row_index": 274, "timestamp": "2018-04-17T21:51:33Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b4709b59-bcae-46bf-b08a-f73a9470cd7a", "eventTime": "2018-04-17T21:51:33Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "666e6e8f-d074-482c-85ac-8887c3618bef", "record_id": "flaws_cloudtrail:0000275:666e6e8f-d074-482c-85ac-8887c3618bef", "row_index": 275, "timestamp": "2018-04-17T21:51:33Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1171, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "666e6e8f-d074-482c-85ac-8887c3618bef", "eventTime": "2018-04-17T21:51:33Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c89aa5c2-568e-47b8-990d-d3ee73810ed2", "record_id": "flaws_cloudtrail:0000276:c89aa5c2-568e-47b8-990d-d3ee73810ed2", "row_index": 276, "timestamp": "2018-04-17T21:51:34Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c89aa5c2-568e-47b8-990d-d3ee73810ed2", "eventTime": "2018-04-17T21:51:34Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2061b421-7266-497e-8051-b1e946673e", "record_id": "flaws_cloudtrail:0000277:2061b421-7266-497e-8051-b1e946673e", "row_index": 277, "timestamp": "2018-04-17T21:51:34Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1824, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2061b421-7266-497e-8051-b1e946673e", "eventTime": "2018-04-17T21:51:34Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: nmCcPxsaeKjLQsBQW_6OPKLVSmhOI9wL7QjQVwXKeKXTplL-mly5ZTAd6bFAfG9zW_nbNea-G-ue3JpQXhIv-zbdilcF2ZsDB8rsvs83oJbTzw7QVNm9uX3DoOy3n2BSgyCJh4KmU_IOjG0gQwT61GnxKkDihzb-WcP8xW8dBcuByZ1ScpxjXm0ZEZ8-IL9VorDKQB4LZunXU47pfyAXZAC2NBzHhcCNmh95Wvjjd3We5gypRQ2qoQ29UqqS-49NCYstmtP2pLeXwU6tExhgID_IGuYxS873xAKXSVSmU-9anvVMSFUJ580hobOkkVYBCJwi4mlKnQsLMO_UqQKNbLLHFHziN74R5Lo1pkZVx3c4hGnC-Kz3IMkMHWEaxIFdygbjZ1wTRGU2kQHNKAYQ1Sspdv4MFb4tq2sxJh5-LCjGjc8iFT5dxdXvmJ8FyP6IykGpzrxUcuuJji0qp_krtE2_Un8SFivlUihAaq0BVJ_augK_PwoIEZAK9c6i0jR85up5EZWjlgWDHA0ZFPNOi_d9L-7_FdLJteBJdVCQ8vHUAS8opX7mPmBwLe2hEbAeoWfQqbeOEUFzZcoNCu4s15JmOL1bzDQtZGDj0st1XUYjzAQUJ5fyzKEICUti0ubS5z3tx1xZB98sfoVSxqWnuXfdAdhjK_OQ9_M", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "52765e9-237a-43e7-9306-d071c914518d", "record_id": "flaws_cloudtrail:0000278:52765e9-237a-43e7-9306-d071c914518d", "row_index": 278, "timestamp": "2018-04-17T21:51:35Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "52765e9-237a-43e7-9306-d071c914518d", "eventTime": "2018-04-17T21:51:35Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5cf30fb5-2dd3-440e-9e5b-9d701df7f793", "record_id": "flaws_cloudtrail:0000279:5cf30fb5-2dd3-440e-9e5b-9d701df7f793", "row_index": 279, "timestamp": "2018-04-17T21:51:35Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 814, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5cf30fb5-2dd3-440e-9e5b-9d701df7f793", "eventTime": "2018-04-17T21:51:35Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "51f649cf-be58-47c4-ae52-decefdbcbd89", "record_id": "flaws_cloudtrail:0000280:51f649cf-be58-47c4-ae52-decefdbcbd89", "row_index": 280, "timestamp": "2018-04-17T21:51:35Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "51f649cf-be58-47c4-ae52-decefdbcbd89", "eventTime": "2018-04-17T21:51:35Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b140c50d-1f0a-4a48-b85a-b615e1256223", "record_id": "flaws_cloudtrail:0000281:b140c50d-1f0a-4a48-b85a-b615e1256223", "row_index": 281, "timestamp": "2018-04-17T21:51:35Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b140c50d-1f0a-4a48-b85a-b615e1256223", "eventTime": "2018-04-17T21:51:35Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0735b475-720c-4a03-8184-c4f3f20f8860", "record_id": "flaws_cloudtrail:0000282:0735b475-720c-4a03-8184-c4f3f20f8860", "row_index": 282, "timestamp": "2018-04-17T21:51:36Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0735b475-720c-4a03-8184-c4f3f20f8860", "eventTime": "2018-04-17T21:51:36Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2d66837-0ab3-4baf-adf6-1de1ff107956", "record_id": "flaws_cloudtrail:0000283:2d66837-0ab3-4baf-adf6-1de1ff107956", "row_index": 283, "timestamp": "2018-04-17T21:51:36Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2d66837-0ab3-4baf-adf6-1de1ff107956", "eventTime": "2018-04-17T21:51:36Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9e3be10d-ef50-465d-af60-e3750a13d2c3", "record_id": "flaws_cloudtrail:0000284:9e3be10d-ef50-465d-af60-e3750a13d2c3", "row_index": 284, "timestamp": "2018-04-17T21:51:36Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9e3be10d-ef50-465d-af60-e3750a13d2c3", "eventTime": "2018-04-17T21:51:36Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "24f1f451-c9e9-4bb7-ba00-d49c1884c4de", "record_id": "flaws_cloudtrail:0000285:24f1f451-c9e9-4bb7-ba00-d49c1884c4de", "row_index": 285, "timestamp": "2018-04-17T21:51:36Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1828, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "24f1f451-c9e9-4bb7-ba00-d49c1884c4de", "eventTime": "2018-04-17T21:51:36Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: zo91v2pfMnzBUjnzrSZVZ6SQegMqgZNvsw6C6pqw4Cj-K3N4fjkD-o_wGmfAZ9tjIU1GTZ3InOwtRZcM523AvoNhcug40sObQ1zT8RUv1NnAf1xGMWqrVZhrXnlqBEWqpzxagUhZVbdAkQsrT-aN0qaXyeg_6fqpzrMpAYc9ZeYavi0h-EiuFdlIr21pD1e3wPL_pZPT05wh9zsBZlyak1FT3FdT4gKIdsOwxe3qfiX4YOCwL9itu_5jEj8Et5MPG1iaV4ngjkfUir-SGV4BmnXxTVTxeOq75cCwrJB2hKIJ-B3i3pXjJlu9GJyoJvNzGPp0o1Ix1pf7rl-ySLiNp65ujyJG2lWctZyXOlpdUlW0CQrZBlr3kCnWL9sFb9MXV8gs0pqQBepczyPfl0pDJwyERTfEMF5_NhHKMfnfFoyxlEstYVBUUHWmqpNdeeXItkInSv4l-4J2c0mh6r6UyDyA9Wk8s7Q8kaT2R5XezwYLrmohadkG4PcPmEyPMjW4OdHSE0TxJEtJm0ipFdSyWqI5YX1tbTYAR3fL-jj1ShbeC7kii69VOzICkeOmC7v-SbrCdrn9Dj1J3-wR_LlMnWaBeaOPWBEoXGwEfKNd2EbxZqKL2QgWjjgPqzFI-EdF7MXggVEXt937FpP_IMHFdoE8zOOC7u6Abxw", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8b137f97-685a-4413-9d74-25eed336d43c", "record_id": "flaws_cloudtrail:0000286:8b137f97-685a-4413-9d74-25eed336d43c", "row_index": 286, "timestamp": "2018-04-17T21:51:37Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8b137f97-685a-4413-9d74-25eed336d43c", "eventTime": "2018-04-17T21:51:37Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a2a49d1a-10d6-40f6-aee1-e57f2961dd74", "record_id": "flaws_cloudtrail:0000287:a2a49d1a-10d6-40f6-aee1-e57f2961dd74", "row_index": 287, "timestamp": "2018-04-17T21:51:37Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a2a49d1a-10d6-40f6-aee1-e57f2961dd74", "eventTime": "2018-04-17T21:51:37Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4a53a417-6b23-4494-9d77-f9d21593", "record_id": "flaws_cloudtrail:0000288:4a53a417-6b23-4494-9d77-f9d21593", "row_index": 288, "timestamp": "2018-04-17T21:51:37Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4a53a417-6b23-4494-9d77-f9d21593", "eventTime": "2018-04-17T21:51:37Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9659b327-af22-4330-ac19-769c177d7829", "record_id": "flaws_cloudtrail:0000289:9659b327-af22-4330-ac19-769c177d7829", "row_index": 289, "timestamp": "2018-04-17T21:51:38Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9659b327-af22-4330-ac19-769c177d7829", "eventTime": "2018-04-17T21:51:38Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "07a286222-5046-4e49-83ef-c7b9901c8592", "record_id": "flaws_cloudtrail:0000290:07a286222-5046-4e49-83ef-c7b9901c8592", "row_index": 290, "timestamp": "2018-04-17T21:51:38Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "07a286222-5046-4e49-83ef-c7b9901c8592", "eventTime": "2018-04-17T21:51:38Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "78091-913f-401d-b65c-3b0975235a4b", "record_id": "flaws_cloudtrail:0000291:78091-913f-401d-b65c-3b0975235a4b", "row_index": 291, "timestamp": "2018-04-17T21:51:38Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1169, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "78091-913f-401d-b65c-3b0975235a4b", "eventTime": "2018-04-17T21:51:38Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "531919b-0bb5-4409-99b2-fac88377cd8", "record_id": "flaws_cloudtrail:0000292:531919b-0bb5-4409-99b2-fac88377cd8", "row_index": 292, "timestamp": "2018-04-17T21:51:39Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1174, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "531919b-0bb5-4409-99b2-fac88377cd8", "eventTime": "2018-04-17T21:51:39Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7a5d582f-1e0f-4e7c-8a6d-01e14d751e43", "record_id": "flaws_cloudtrail:0000293:7a5d582f-1e0f-4e7c-8a6d-01e14d751e43", "row_index": 293, "timestamp": "2018-04-17T21:51:39Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7a5d582f-1e0f-4e7c-8a6d-01e14d751e43", "eventTime": "2018-04-17T21:51:39Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e0952ed9-683b-41d9-9912-5f541434fa0", "record_id": "flaws_cloudtrail:0000294:e0952ed9-683b-41d9-9912-5f541434fa0", "row_index": 294, "timestamp": "2018-04-17T21:51:39Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e0952ed9-683b-41d9-9912-5f541434fa0", "eventTime": "2018-04-17T21:51:39Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3c065113-4c54-4144-97ec-42310aa62ee3", "record_id": "flaws_cloudtrail:0000295:3c065113-4c54-4144-97ec-42310aa62ee3", "row_index": 295, "timestamp": "2018-04-17T21:51:39Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1280, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3c065113-4c54-4144-97ec-42310aa62ee3", "eventTime": "2018-04-17T21:51:39Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "253d260e-9500-4982-9c5b-e0da75c28fd5", "record_id": "flaws_cloudtrail:0000296:253d260e-9500-4982-9c5b-e0da75c28fd5", "row_index": 296, "timestamp": "2018-04-17T21:51:40Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1835, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "253d260e-9500-4982-9c5b-e0da75c28fd5", "eventTime": "2018-04-17T21:51:40Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: zitsm4PlVU3dDudNQ6UM5_C_8kw6qnp0MZ3mdhZZCBNb1m6gFN1YKTRYt_cFcbF1PYlqAJNaG3Y7AJHgUblxKzIDYrHZBgX3bFu8DQDPgwsvzA2Nrfk8X1Omu255pLP62O4RhE3pMGjYAGoECREJvPQFnuRnvGkhYzjmTAXHw0heovvevK4m38K0BvErGN644t32YRF6MXjC1dAV1aPmQUEFnyfyrIkuhx1G-opK_asXACf7aunxz-1t1aNZ_W5rhA3qP_GiY0PEYdvXc-xelpTEvHiPA98f5OvhwVz7lY11VS-OfpSM5-G3vSO5S42_N7aP6iajw3o0UQcFwS-WwWKEvEKPWbIKz5ghvy8DhXKCWUc3o6GjKXhTOIeTKdE9rOI8056vwnoEH83OVUocU3_nbdhPvp5QTarXXjAFhdCczjlUEC8Hmr4WjgYwumt3bB12lfhOt9lYSL3er_yifbYZlkimFSX-69f6AdJ-cpCehV1iuGLoDtS-uEGBuD5K-HEvc0fZo-63crxKQPrfOef-4BfdcnWjuOByjRnPEV92iuW_2KKQJXLd_z-aGTUoxkmNuZ_AKYq_qniDP76ko_zOfUXSdhY23ZcUbbnajz7qECZEqGVtmSiLLVpFxtrDwVGbd8UoUK3SlAP0Xzrblh7Hy6fXUzWYpyJzT6zG", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4c8d2bb0-a656-49f8-953a-e3c88cdf1cc8", "record_id": "flaws_cloudtrail:0000297:4c8d2bb0-a656-49f8-953a-e3c88cdf1cc8", "row_index": 297, "timestamp": "2018-04-17T21:51:40Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4c8d2bb0-a656-49f8-953a-e3c88cdf1cc8", "eventTime": "2018-04-17T21:51:40Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9b06c2bd-481a-49fd-9a5c-8834f62295e6", "record_id": "flaws_cloudtrail:0000298:9b06c2bd-481a-49fd-9a5c-8834f62295e6", "row_index": 298, "timestamp": "2018-04-17T21:51:40Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9b06c2bd-481a-49fd-9a5c-8834f62295e6", "eventTime": "2018-04-17T21:51:40Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "77c1fee5-08cc-4d29-8499-dbce581d7139", "record_id": "flaws_cloudtrail:0000299:77c1fee5-08cc-4d29-8499-dbce581d7139", "row_index": 299, "timestamp": "2018-04-17T21:51:40Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1280, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "77c1fee5-08cc-4d29-8499-dbce581d7139", "eventTime": "2018-04-17T21:51:40Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "382e158c-c96e-445a-a14c-750d4b3c343a", "record_id": "flaws_cloudtrail:0000300:382e158c-c96e-445a-a14c-750d4b3c343a", "row_index": 300, "timestamp": "2018-04-17T21:51:40Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1828, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "382e158c-c96e-445a-a14c-750d4b3c343a", "eventTime": "2018-04-17T21:51:40Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 02Vy8NBdAyC6hIU2lZiFqHniISuSDOl06pHtTz4JuaTghS_fprvOq9OZ38t77uqxAwzlmZEfGJHp4Bee2ca0SZEeQf6HbSyr8VxLNgXlv6huEnikC3YglqUNlFodcKOUcBv6zWFqgERHxEQ_Qv_Zz8n1VyCYOyadvisi38ijDWlsFUAxe7e7YKPw2ybzRRyvDDReBtfQfCzLy9uB0eLUHdiHIHoxQ3ztV23_0s1p83PYbFn2hOyo5Ae5ZpX87PNnnODtXlb1X5qM83W50wjVWUzRpIc6H_gGmkjh7xKgdhV6ZeHOJ0MDUYZxmFikuOnJ3zCTNN18YnJrOXqZk05lINg0i58-dGdzi-fdmj0TtGa3HLRnsTiX4xo4_wzsgFqkcK5yE9ihh4MSdvzMXHm1qkBDfRiitVPlFRkPN0Y3iEam7NxgatU_ToUqt-IUmBwRiH51pt5BBgPJ9pB0rCVXpf5u-26llYxRF1f0XyNy4un7LJvftBJ7OXbZ5HvvLnZR5MPAq8TlDCaCqFfZmYH6spJx7NPEBTDRyHFc5qEGQxtA2zIdsRGRku5HO2K8IBv1UHiSMgG0xlo-GJMARy-HKJiuViAwEFGwtQ-EWgsXJ1XMkZQoiRS-Oq7Jue90TwPtYOdvq8K8glcvGv2a3pH40cS1Mw0LGgApbg", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e5861b16-8445-4d4b-a354-b126fb705549", "record_id": "flaws_cloudtrail:0000301:e5861b16-8445-4d4b-a354-b126fb705549", "row_index": 301, "timestamp": "2018-04-17T21:51:41Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1281, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e5861b16-8445-4d4b-a354-b126fb705549", "eventTime": "2018-04-17T21:51:41Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "827b19fa-65a5-4fae-a4a5-200ad9b4125a", "record_id": "flaws_cloudtrail:0000302:827b19fa-65a5-4fae-a4a5-200ad9b4125a", "row_index": 302, "timestamp": "2018-04-17T21:51:41Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "827b19fa-65a5-4fae-a4a5-200ad9b4125a", "eventTime": "2018-04-17T21:51:41Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8bd95eb3-7c7c-483c-83ab-ad67eb1e05d7", "record_id": "flaws_cloudtrail:0000303:8bd95eb3-7c7c-483c-83ab-ad67eb1e05d7", "row_index": 303, "timestamp": "2018-04-17T21:51:41Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8bd95eb3-7c7c-483c-83ab-ad67eb1e05d7", "eventTime": "2018-04-17T21:51:41Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bac544879-5a33-493f-b955-84fd032521", "record_id": "flaws_cloudtrail:0000304:bac544879-5a33-493f-b955-84fd032521", "row_index": 304, "timestamp": "2018-04-17T21:51:42Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bac544879-5a33-493f-b955-84fd032521", "eventTime": "2018-04-17T21:51:42Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a5df4582-fcb2-4572-9291-891607ecf784", "record_id": "flaws_cloudtrail:0000305:a5df4582-fcb2-4572-9291-891607ecf784", "row_index": 305, "timestamp": "2018-04-17T21:51:42Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a5df4582-fcb2-4572-9291-891607ecf784", "eventTime": "2018-04-17T21:51:42Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8273ad20-8e9b-4713-970e-97a57c12f74a", "record_id": "flaws_cloudtrail:0000306:8273ad20-8e9b-4713-970e-97a57c12f74a", "row_index": 306, "timestamp": "2018-04-17T21:51:42Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1174, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8273ad20-8e9b-4713-970e-97a57c12f74a", "eventTime": "2018-04-17T21:51:42Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d84b715c-f48f-459d-9aa8-4754d222b1bf", "record_id": "flaws_cloudtrail:0000307:d84b715c-f48f-459d-9aa8-4754d222b1bf", "row_index": 307, "timestamp": "2018-04-17T21:51:42Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d84b715c-f48f-459d-9aa8-4754d222b1bf", "eventTime": "2018-04-17T21:51:42Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "34e44e3e-c4e2-4d0d-a3c5-eb755d9cd53c", "record_id": "flaws_cloudtrail:0000308:34e44e3e-c4e2-4d0d-a3c5-eb755d9cd53c", "row_index": 308, "timestamp": "2018-04-17T21:51:43Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "34e44e3e-c4e2-4d0d-a3c5-eb755d9cd53c", "eventTime": "2018-04-17T21:51:43Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "85e66ed5-72c8-4f23-b0a5-84a7fbd5990c", "record_id": "flaws_cloudtrail:0000309:85e66ed5-72c8-4f23-b0a5-84a7fbd5990c", "row_index": 309, "timestamp": "2018-04-17T21:51:43Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1835, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "85e66ed5-72c8-4f23-b0a5-84a7fbd5990c", "eventTime": "2018-04-17T21:51:43Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: hiQ1RdSD-pKiRoStn3fF_dhI5nHWEvfK8K44T-OB1tdPbnivbZLp2TKE7TRi6-2ZgcBWvgMYQfBpaOBSq3l3BfvTJYEVAD9ftp4L4I8rGGl5_UnEnpQITAX3CjJehlRWwCKxAE2ObGZ0hLcQsJIDEUeJBO4_MlsrVHg2qpI16cLabUk1mnmWJLLjF13OTFZTPjcXGhrTZisUCKe0x2esVXfrVlduSp51frdTBb7yaNYw1gFbzfAZGKXJxLPHdKAD_twRfcqv9PI-0Ia18mbwVsd1ruud6Uy6eLHBsqWp0LJyje2VexoraUD1GzgfNxaoG_KpJpoe7GQrZ_jzUBqZDn_QrtkMXzC0V8pLRB7auk8yGMTTRMZnxVe9Nr2mRVTQFL7zyRl_3VxuLrNbedGh_doMAbGsJVVFFpDdlxrfYaWQUgirRvzIR4orn2nkLNu-rIuD1HohsH4l10YPDWwWhIuXriNOL8fi2_GoXNcjbDdxPtkKSnzviGrwFjsk6ygeliwyWpQ4u_FX7L6ebBYRNCHJvTMIhZOQlDMMsSo1TM24d9TMUjhPw4R8suRtX7gBZFy3wIBq_6kPJBMPcRjjIg0Lfqd9fPjIjFqPcCqBaOS5nvi6FT6ePTnBGrLEsqIdl04bhPheOgFXwK2pfRigkxjt4bCje71HdZvp_w", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f775b805-53a3-4885-9b01-7f598ea9d79f", "record_id": "flaws_cloudtrail:0000310:f775b805-53a3-4885-9b01-7f598ea9d79f", "row_index": 310, "timestamp": "2018-04-17T21:51:43Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f775b805-53a3-4885-9b01-7f598ea9d79f", "eventTime": "2018-04-17T21:51:43Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a5be8a91-2064-45cc-a388-5a04415f115", "record_id": "flaws_cloudtrail:0000311:a5be8a91-2064-45cc-a388-5a04415f115", "row_index": 311, "timestamp": "2018-04-17T21:51:44Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1836, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a5be8a91-2064-45cc-a388-5a04415f115", "eventTime": "2018-04-17T21:51:44Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: gCDTwV0gYYSu0sOi_0G5_7toG1_oKyWZYPqchGbJzJd6dFEjNiGA2U0pMGMHOCedUu3SOnLh5hY51UozOCEy7Gio2yUVlUd_nmTpP5eIJaAM5tJfV5h0tITTWKBWdZkenZifXJqy2U6M-1Nk0fNEGO8j6A2ahS6RdcWa35PzMVOpB1ColfV5E6GU-b-W19TGQ-dbagw3uJneLkvfOzIwInKOs7d-UgKd1WZ5tr8CqJBglbJN5lZwIn_XXiBoEf0Gia_lX-EZ59joMBQnNxbRnhVCK1HW418_eb6m-vPU408h28RFyi7_bM0wSUd34foz5_uJktzOUozqqXIrGtGZd5t05qq49IETc0dpVkRSyscgI6o2pjJLqrJViu-iNsPSb-X-Ovpcc2v7kPF7udbZHvN2s4whPh4hUeAqaC4Mw-E_-d7GiMzpH7VOX07czXfumrxwPqik_6k0jooDZQC1ZcGV2KacOWGUQChovpPqHUZQLt3LTtijOZK78uNQ8wYvva5uS4i1mX8ZEeUYpXwDY2UPiaSQ6uVGpXSSZfbjm2Uikm3o2dI-NG2WbJMk8UHxfbKTrtOtHn4Fb15vNHWp6--J4RUYp7uEzJ2wt5miTc3GkHxLEm8-iMEU6zZCAaq7S-8rIQD7X74T2n2wdMnTyeXb4RQqzuzvunlAndE", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "af5bde1b-b3b6-4d36-92d7-d27b9beb4c92", "record_id": "flaws_cloudtrail:0000312:af5bde1b-b3b6-4d36-92d7-d27b9beb4c92", "row_index": 312, "timestamp": "2018-04-17T21:51:44Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 812, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "af5bde1b-b3b6-4d36-92d7-d27b9beb4c92", "eventTime": "2018-04-17T21:51:44Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6e36c929-7e42-412a-9f67-a3b4156a82aa", "record_id": "flaws_cloudtrail:0000313:6e36c929-7e42-412a-9f67-a3b4156a82aa", "row_index": 313, "timestamp": "2018-04-17T21:51:44Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6e36c929-7e42-412a-9f67-a3b4156a82aa", "eventTime": "2018-04-17T21:51:44Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f48e7ad6-be4d-41a7-aa42-3d2ca5510a19", "record_id": "flaws_cloudtrail:0000314:f48e7ad6-be4d-41a7-aa42-3d2ca5510a19", "row_index": 314, "timestamp": "2018-04-17T21:51:45Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f48e7ad6-be4d-41a7-aa42-3d2ca5510a19", "eventTime": "2018-04-17T21:51:45Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bbab4a55-0852-42b6-b49f-d65659764ac1", "record_id": "flaws_cloudtrail:0000315:bbab4a55-0852-42b6-b49f-d65659764ac1", "row_index": 315, "timestamp": "2018-04-17T21:51:45Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bbab4a55-0852-42b6-b49f-d65659764ac1", "eventTime": "2018-04-17T21:51:45Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "584d2e68-3c4d-4c72-9772-0dee5bf4bcf9", "record_id": "flaws_cloudtrail:0000316:584d2e68-3c4d-4c72-9772-0dee5bf4bcf9", "row_index": 316, "timestamp": "2018-04-17T21:51:45Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1274, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "584d2e68-3c4d-4c72-9772-0dee5bf4bcf9", "eventTime": "2018-04-17T21:51:45Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f0f7a69f-0fb3-4d32-beac-6a8a0be1de1f", "record_id": "flaws_cloudtrail:0000317:f0f7a69f-0fb3-4d32-beac-6a8a0be1de1f", "row_index": 317, "timestamp": "2018-04-17T21:51:46Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f0f7a69f-0fb3-4d32-beac-6a8a0be1de1f", "eventTime": "2018-04-17T21:51:46Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1ccf7261-cf0f-4fa3-a514-723f52320ca", "record_id": "flaws_cloudtrail:0000318:1ccf7261-cf0f-4fa3-a514-723f52320ca", "row_index": 318, "timestamp": "2018-04-17T21:51:46Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1ccf7261-cf0f-4fa3-a514-723f52320ca", "eventTime": "2018-04-17T21:51:46Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fb36ba88-5164-4d2e-975b-a7f7efcdc962", "record_id": "flaws_cloudtrail:0000319:fb36ba88-5164-4d2e-975b-a7f7efcdc962", "row_index": 319, "timestamp": "2018-04-17T21:51:46Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fb36ba88-5164-4d2e-975b-a7f7efcdc962", "eventTime": "2018-04-17T21:51:46Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "216f84f5-f4fc-4e46-ada8-6f919d6d25d4", "record_id": "flaws_cloudtrail:0000320:216f84f5-f4fc-4e46-ada8-6f919d6d25d4", "row_index": 320, "timestamp": "2018-04-17T21:51:47Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "216f84f5-f4fc-4e46-ada8-6f919d6d25d4", "eventTime": "2018-04-17T21:51:47Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "754176e3b-658f-4c36-9d8a-bf0a989a7350", "record_id": "flaws_cloudtrail:0000321:754176e3b-658f-4c36-9d8a-bf0a989a7350", "row_index": 321, "timestamp": "2018-04-17T21:51:47Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "754176e3b-658f-4c36-9d8a-bf0a989a7350", "eventTime": "2018-04-17T21:51:47Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1075f3a2-d2ea-4180-99a3-8626cb9e58e0", "record_id": "flaws_cloudtrail:0000322:1075f3a2-d2ea-4180-99a3-8626cb9e58e0", "row_index": 322, "timestamp": "2018-04-17T21:51:48Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1075f3a2-d2ea-4180-99a3-8626cb9e58e0", "eventTime": "2018-04-17T21:51:48Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "96dcbe3b-0c4c-4520-9b0f-7b59e8f25703", "record_id": "flaws_cloudtrail:0000323:96dcbe3b-0c4c-4520-9b0f-7b59e8f25703", "row_index": 323, "timestamp": "2018-04-17T21:51:48Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "96dcbe3b-0c4c-4520-9b0f-7b59e8f25703", "eventTime": "2018-04-17T21:51:48Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be280a8f-fdc1-47a4-911f-a09c538100a1", "record_id": "flaws_cloudtrail:0000324:be280a8f-fdc1-47a4-911f-a09c538100a1", "row_index": 324, "timestamp": "2018-04-17T21:51:48Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1828, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be280a8f-fdc1-47a4-911f-a09c538100a1", "eventTime": "2018-04-17T21:51:48Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: cybDikofzEy_hVQEkp8EowMfih4bmakfkqAbKcHfpQgF1fTKOoh7039iOGPJ2TLCgbY4W6lWzlxrKCUOH3G9fx8oZlzSQBd0s0FK_cqsHJByaBu0lRoDs2pvB7dzIFQ6oRDl19K9bi2ZTkIN4rjaAb41FcyufoJhUEK0N0r5Y_n9NrmtZv_frpbxPiwyHmIwnpZdqWx8v9sFR9wZpyAkN6esivoujvJYhtxF29Gqyxo8fNFjOpfdSglHVdK5gzIdREDZ4HTgkXZpW92BUVe6qJCZLeL1KcPcZR6rqm82outmzdkaOL62vgWZaBCw35PIwo6sSaCAKkS7y2sFv0uhCykq7tgCQLDjGlTM8EEwQMFJDPEQ4FBcrh0z0GPas3KPdSjnjw77rfthy1dpsVABU4cIt_AxO1fKpaAFnzgXRML-vISkVklaNHmQwrlnQi0XiSz7dtYFr8TZZpGPKBv7J-zNk2XIuCDMYEJ331ICZrLnU-YuQeSaO2WYhb-rqbsj-h5uhCLhkuuS0OAa5bwsRLzrrbNT4EDFsAa41jPV94U63BjmBWE4meI_uvaZUR3_WQ_-PbRai3fTeo_rcmufJ_oFJjOhhlGgNXlsZrU-5lAIjXg0aPP84lYaPjX4dMsXBX2HIkZ9qAce42DlH0xEeLXAKWwcWQOr_BY", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bfc22281-f873-4f6f-a6da-ec339fd64370", "record_id": "flaws_cloudtrail:0000325:bfc22281-f873-4f6f-a6da-ec339fd64370", "row_index": 325, "timestamp": "2018-04-17T21:51:49Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bfc22281-f873-4f6f-a6da-ec339fd64370", "eventTime": "2018-04-17T21:51:49Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f719949c-ef97-4dde-971b-afb6da8be5e6", "record_id": "flaws_cloudtrail:0000326:f719949c-ef97-4dde-971b-afb6da8be5e6", "row_index": 326, "timestamp": "2018-04-17T21:51:49Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f719949c-ef97-4dde-971b-afb6da8be5e6", "eventTime": "2018-04-17T21:51:49Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "554879-3f34-4af9-a9a2-2d3cdf98ea93", "record_id": "flaws_cloudtrail:0000327:554879-3f34-4af9-a9a2-2d3cdf98ea93", "row_index": 327, "timestamp": "2018-04-17T21:51:49Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "554879-3f34-4af9-a9a2-2d3cdf98ea93", "eventTime": "2018-04-17T21:51:49Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b4397d8e-10d3-4781-80ef-fce4dba70e6c", "record_id": "flaws_cloudtrail:0000328:b4397d8e-10d3-4781-80ef-fce4dba70e6c", "row_index": 328, "timestamp": "2018-04-17T21:51:49Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b4397d8e-10d3-4781-80ef-fce4dba70e6c", "eventTime": "2018-04-17T21:51:49Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5b1b2d9c-1c54-49b6-95d7-481f77967a7e", "record_id": "flaws_cloudtrail:0000329:5b1b2d9c-1c54-49b6-95d7-481f77967a7e", "row_index": 329, "timestamp": "2018-04-17T21:51:49Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5b1b2d9c-1c54-49b6-95d7-481f77967a7e", "eventTime": "2018-04-17T21:51:49Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "51ca66fa-ad34-41bc-9bf3-751c8a359b30", "record_id": "flaws_cloudtrail:0000330:51ca66fa-ad34-41bc-9bf3-751c8a359b30", "row_index": 330, "timestamp": "2018-04-17T21:51:50Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "51ca66fa-ad34-41bc-9bf3-751c8a359b30", "eventTime": "2018-04-17T21:51:50Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "37ef0afc-0f54-4ae0-bddf-cf68d0b99204", "record_id": "flaws_cloudtrail:0000331:37ef0afc-0f54-4ae0-bddf-cf68d0b99204", "row_index": 331, "timestamp": "2018-04-17T21:51:50Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "37ef0afc-0f54-4ae0-bddf-cf68d0b99204", "eventTime": "2018-04-17T21:51:50Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c96e3b9b-b735-47e2-af62-1ac32daf82e1", "record_id": "flaws_cloudtrail:0000332:c96e3b9b-b735-47e2-af62-1ac32daf82e1", "row_index": 332, "timestamp": "2018-04-17T21:51:50Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c96e3b9b-b735-47e2-af62-1ac32daf82e1", "eventTime": "2018-04-17T21:51:50Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a0fc3dfc-1150-46fd-864a-17edb7be1328", "record_id": "flaws_cloudtrail:0000333:a0fc3dfc-1150-46fd-864a-17edb7be1328", "row_index": 333, "timestamp": "2018-04-17T21:51:50Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1171, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a0fc3dfc-1150-46fd-864a-17edb7be1328", "eventTime": "2018-04-17T21:51:50Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "afe67ed2-288a-444c-b7cd-24aac7069dde", "record_id": "flaws_cloudtrail:0000334:afe67ed2-288a-444c-b7cd-24aac7069dde", "row_index": 334, "timestamp": "2018-04-17T21:51:51Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1281, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "afe67ed2-288a-444c-b7cd-24aac7069dde", "eventTime": "2018-04-17T21:51:51Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e3fb8a27-dfea-4b2a-bf9a-bb4edce1a58b", "record_id": "flaws_cloudtrail:0000335:e3fb8a27-dfea-4b2a-bf9a-bb4edce1a58b", "row_index": 335, "timestamp": "2018-04-17T21:51:51Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e3fb8a27-dfea-4b2a-bf9a-bb4edce1a58b", "eventTime": "2018-04-17T21:51:51Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "63c294b0-555a-4ca9-b528-737737b484bc", "record_id": "flaws_cloudtrail:0000336:63c294b0-555a-4ca9-b528-737737b484bc", "row_index": 336, "timestamp": "2018-04-17T21:51:52Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "63c294b0-555a-4ca9-b528-737737b484bc", "eventTime": "2018-04-17T21:51:52Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0aaf1bcd-3f87-4299-adbc-add1cf037590", "record_id": "flaws_cloudtrail:0000337:0aaf1bcd-3f87-4299-adbc-add1cf037590", "row_index": 337, "timestamp": "2018-04-17T21:51:52Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0aaf1bcd-3f87-4299-adbc-add1cf037590", "eventTime": "2018-04-17T21:51:52Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "edac1cd1-e56f-47e2-b4ed-7d22bcb34ca7", "record_id": "flaws_cloudtrail:0000338:edac1cd1-e56f-47e2-b4ed-7d22bcb34ca7", "row_index": 338, "timestamp": "2018-04-17T21:51:52Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1827, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "edac1cd1-e56f-47e2-b4ed-7d22bcb34ca7", "eventTime": "2018-04-17T21:51:52Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 9LFPhH2u4Itc4iVAV1L29kTpwzpmHfT1wtZ1z6Uzl-AgOKj1VMpGLmWafOuJf8XOPHCCT3p-NVtdJN4tzk2DDnhVBBhwE6XOy17Q8JuJEEnFWTOFjn6gKo5rT5TJ-PdlLbulZvntis5Dk9ICEhRukvEiCBeXLKUycdqe3up0M8e77hEo18bPnDibt80a0C9JQZMUpaDmkuv3iIu7JPPcytQoXDqhEBBNv8e-pjTBRMBzTSHdWg0sCDsXZl8IHntPwMlfkeLFCM5_YVUDpUqW0J4AcKSw7yov-7RFvzOpruFXmYxV3gcE5IfubFSeR029BERfQQqrdSPRnsrbINwxhuHeRYPYIHc_1Cr-3p7BPWYgptyk0W7blVVtSs03poIsO9CxfJsRv70RSAxZlgMfh7rtP3utVsR4R5_gZcX1Maj4mI8JnrfGL84xPVJSBUbPMSQ2oPGqZVSL2XJ9eu46sgArkuJmnqR1xRVVmky-yMn98-FLRnaanKvNIWukPipDMWanZ5_foYzbXC13Nmq7Po6jsdEJ4ENbpAenmuDeoJdrlJnc-S8qxH_nPr0KP5wzvzIlln6QJz3s9TmBoZ-_PmXHA9SBwsu6r9LEkniBMOfy3lEsHcZz7rCRJfi2JHyuaQBs2K7LAkzTcWqLTZXfB12ASwc1s3FQYg", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "42e600c9-d6b4-42b1-b648-5bfc920aa3d5", "record_id": "flaws_cloudtrail:0000339:42e600c9-d6b4-42b1-b648-5bfc920aa3d5", "row_index": 339, "timestamp": "2018-04-17T21:51:53Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1172, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "42e600c9-d6b4-42b1-b648-5bfc920aa3d5", "eventTime": "2018-04-17T21:51:53Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "77ea70f2-8ba4-4064-beea-7600d5a9180e", "record_id": "flaws_cloudtrail:0000340:77ea70f2-8ba4-4064-beea-7600d5a9180e", "row_index": 340, "timestamp": "2018-04-17T21:51:53Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1280, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "77ea70f2-8ba4-4064-beea-7600d5a9180e", "eventTime": "2018-04-17T21:51:53Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4bc492c2-f6ce-49f7-92db-12ef4caf2eb1", "record_id": "flaws_cloudtrail:0000341:4bc492c2-f6ce-49f7-92db-12ef4caf2eb1", "row_index": 341, "timestamp": "2018-04-17T21:51:53Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4bc492c2-f6ce-49f7-92db-12ef4caf2eb1", "eventTime": "2018-04-17T21:51:53Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c25f5766-f4b1-43cf-b2fa-89d340beb50c", "record_id": "flaws_cloudtrail:0000342:c25f5766-f4b1-43cf-b2fa-89d340beb50c", "row_index": 342, "timestamp": "2018-04-17T21:51:53Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c25f5766-f4b1-43cf-b2fa-89d340beb50c", "eventTime": "2018-04-17T21:51:53Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dd4605bb-5c8b-4bde-84c3-2d55061ea", "record_id": "flaws_cloudtrail:0000343:dd4605bb-5c8b-4bde-84c3-2d55061ea", "row_index": 343, "timestamp": "2018-04-17T21:51:53Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dd4605bb-5c8b-4bde-84c3-2d55061ea", "eventTime": "2018-04-17T21:51:53Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "17bac1e8-87f7-43fd-a9af-fd57a3fe39e1", "record_id": "flaws_cloudtrail:0000344:17bac1e8-87f7-43fd-a9af-fd57a3fe39e1", "row_index": 344, "timestamp": "2018-04-17T21:51:54Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1174, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "17bac1e8-87f7-43fd-a9af-fd57a3fe39e1", "eventTime": "2018-04-17T21:51:54Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e695847c-0774-4cee-91e3-c642385f8df", "record_id": "flaws_cloudtrail:0000345:e695847c-0774-4cee-91e3-c642385f8df", "row_index": 345, "timestamp": "2018-04-17T21:51:54Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1279, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e695847c-0774-4cee-91e3-c642385f8df", "eventTime": "2018-04-17T21:51:54Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "33807c79-aeaf-43e0-b364-911f41dd2266", "record_id": "flaws_cloudtrail:0000346:33807c79-aeaf-43e0-b364-911f41dd2266", "row_index": 346, "timestamp": "2018-04-17T21:51:54Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "33807c79-aeaf-43e0-b364-911f41dd2266", "eventTime": "2018-04-17T21:51:54Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "99b59060-007d-4fd9-b3c1-0ee769b46df4", "record_id": "flaws_cloudtrail:0000347:99b59060-007d-4fd9-b3c1-0ee769b46df4", "row_index": 347, "timestamp": "2018-04-17T21:51:55Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1827, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "99b59060-007d-4fd9-b3c1-0ee769b46df4", "eventTime": "2018-04-17T21:51:55Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: xNWSfznsG7_eNYeeOWMy2ozMD2fhAyYmGP4drx1UPzXB65RdY0FJgIv2VGQ1gBWyuDYrKceyKxZ5E3MUUgSsxzwnducMfSr23GwOkeFoczJtuD4OsuBF0PeQ56JDfPbSH27pJp0q73vhpRj_3O5hF0QMcz-xHYCrOM6uul7Iox1TaeQ5PciW2EOV66sCaP1hyVVkvQVxMMVXHO5LRXVrNrgszO_EzD5ZFSKaUJ45DLpljSatnbeNzzw3J5WgsBZWQ6k36csuq8nQh5DExk1z3hYOJqneXfYTIl0Tu5ehPXWQ2CUIVAF2pIX5WW4aFSRvZfYZq9BPdGo72l-vLqcECdUMm4r0iqCufgAxqbPYji8UM6HMZEA4PWvBYuJ61UgySQ9RHFpSvry68w-OSOPFdA6hofwUawPpS67xYIyDjgaGedWBNUk1UDtEZ_eolOSyI87iMFt31SAcLXkV3Gf3RudT23dZxYxW1CrZWzZSXLtt8Fm0ToIxAjxi-FwGhSfjvFQxEz3pyijIxez2cs3ILEN-IsT9AvUkWRbcMHgWutHNt7iis_Nx9MtQvGJ1szyttHZZI9Qf8M8BpHwW2rKMvKBVEPLAvzYOL65pAhh6Np83-Ah_dLAjaC7wR1aBsFR_PQLcr-Ew6zOCv2vvJmjCKPChTxwYWhtCE4AB", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "825f49a4-5985-4532-9268-f2505c559b92", "record_id": "flaws_cloudtrail:0000348:825f49a4-5985-4532-9268-f2505c559b92", "row_index": 348, "timestamp": "2018-04-17T21:51:55Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1832, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "825f49a4-5985-4532-9268-f2505c559b92", "eventTime": "2018-04-17T21:51:55Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: oG4VKSMtguN_q51QsrwxgphpCnfSsoPwYmaHO-5t4xFjkg5jR-s-wgwv-ziYHMVAxLUUnUZr1CvSuZtq23Swp2ShmBdxiCJMX_KafBg0RiGwbR0V_LmhEC480DmvBg2MaWnQW1e0xuBp5w2utvEHwM6J9bPmx2bWc7qK0cYNmPFBVZvXJhnwh98kdhFAuZQVTtko3Dw6j-URPHJ-f0-pT56OAuUWpDpj7VpmyuelIEipo9oFaQDVyRcm9x44XLmRvAd0SUVgtHj2yre-KK9LezLKy8xKASYXS65vs4sybZ2QqcfkgZTDEWyNyKgU5MbW8WwuLBR3PagNU0aDyk9zx_fSIPjDpEC5sFtdWRCdQ9rZnJdEkxWcnCR-uGBBSnEFxSzptYQAaMn98dOmHsxO6gkDaVAa-Lw7d7Kp4z4HT14fduTjp_Dqp1rA1-tEl9ZtCr-YBqoyMBoThY8gpwi3yl3bygGgmFjUzrhOps8GUyjOn19bt_mC-RJUG94CRkW48tYMDikuZaLSteGO9-xeA-DUU0UbCOlMRdgDbq29WaIgkUV3MN7AeOZwRS4yNECQEVIWGBGaU75xB6Faazf7SDzD_jhaC0aIR4IDeIlP3cj75AFGyw_6oRCw70pn9pFBBP2NN1BJap1di0I-t47bbKRcADWNvUGWROx7", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cfcade12-47f8-40d2-afd7-0d1432c37c1a", "record_id": "flaws_cloudtrail:0000349:cfcade12-47f8-40d2-afd7-0d1432c37c1a", "row_index": 349, "timestamp": "2018-04-17T21:51:55Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1827, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cfcade12-47f8-40d2-afd7-0d1432c37c1a", "eventTime": "2018-04-17T21:51:55Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: ta1agPA8WEgRwt6vXlDWxk-EnJ_Se2D_QCjYqp5R039AgTKsNvuVzIJFrD577B4QyXyybohLNVKvGS2IzPB_2jf2Qul4QooDJ6AGM4lWbei5mmb8TrsSq_VMyGgyoqUa6vvikWJ3IKwkwTq9p8oho2OSxwzpz24qA7MVsZMPM9Ns7_b8Ms54jZR4L78Es4zm2hZD6Yj52N2PChTbQijInYqIcZEQ61tR6KertZpq2JnCXCNh6doutMaTFMRiCJiEawFi69sjaIjSqaoy3tbXKfaSBkHr6D9gbio1O-Pmpj49Rb74PFLbJGd2oGKRtl5fDAgezqhGTBZmfXAiGJKtfHGbXixmaBxwn8GZxXqS5F2zxdhMKfOtFOzyZqEFp9JJlg1k2LMbi8aupQkt9WtJqnd6r_X4owGq2nOjisD6xh-m8EH8IUxCSiZn_jv55m2YhqHBnS8i2g8MG9fIOvbGcQmKPuGe1cdNi2M3fJHFB4sdqlM5jlQBebAcz3J7E3yCb2KIOhRVkXVFk15jnfWv-I0sSxgqX6abmZUPaRyblw4ocXIKB4gDPITd6ifh40oLN0gyFkEv_elo2h96QlkgfvUwDL0RWMFMvZ4ip-kJWBxrer3GY0zmUMfPy54k5HEc4PJ5C3FLIO5BEVos1ZGCTCGZnNk09syEMg", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "53dd4a3e-d577-492e-894c-240b1d55b383", "record_id": "flaws_cloudtrail:0000350:53dd4a3e-d577-492e-894c-240b1d55b383", "row_index": 350, "timestamp": "2018-04-17T21:51:56Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "53dd4a3e-d577-492e-894c-240b1d55b383", "eventTime": "2018-04-17T21:51:56Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "71843ef5-84ba-46b3-b123-7a9d44e9e9a5", "record_id": "flaws_cloudtrail:0000351:71843ef5-84ba-46b3-b123-7a9d44e9e9a5", "row_index": 351, "timestamp": "2018-04-17T21:51:57Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "71843ef5-84ba-46b3-b123-7a9d44e9e9a5", "eventTime": "2018-04-17T21:51:57Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "73dec088-d2d6-44c8-8e4b-e1ec645ff27f", "record_id": "flaws_cloudtrail:0000352:73dec088-d2d6-44c8-8e4b-e1ec645ff27f", "row_index": 352, "timestamp": "2018-04-17T21:51:57Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "73dec088-d2d6-44c8-8e4b-e1ec645ff27f", "eventTime": "2018-04-17T21:51:57Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2fed9b97-e888-4fbb-8496-0ae595e8622d", "record_id": "flaws_cloudtrail:0000353:2fed9b97-e888-4fbb-8496-0ae595e8622d", "row_index": 353, "timestamp": "2018-04-17T21:51:58Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2fed9b97-e888-4fbb-8496-0ae595e8622d", "eventTime": "2018-04-17T21:51:58Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "db9c83d1-9549-4d58-87de-2bc47cdda1d0", "record_id": "flaws_cloudtrail:0000354:db9c83d1-9549-4d58-87de-2bc47cdda1d0", "row_index": 354, "timestamp": "2018-04-17T21:51:59Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "db9c83d1-9549-4d58-87de-2bc47cdda1d0", "eventTime": "2018-04-17T21:51:59Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a387a765-087b-4445-96ab-f74907d7cdfd", "record_id": "flaws_cloudtrail:0000355:a387a765-087b-4445-96ab-f74907d7cdfd", "row_index": 355, "timestamp": "2018-04-17T21:51:59Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a387a765-087b-4445-96ab-f74907d7cdfd", "eventTime": "2018-04-17T21:51:59Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9f9d5d19-25b0-4d26-91a2-5c79ce887029", "record_id": "flaws_cloudtrail:0000356:9f9d5d19-25b0-4d26-91a2-5c79ce887029", "row_index": 356, "timestamp": "2018-04-17T21:52:00Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1171, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9f9d5d19-25b0-4d26-91a2-5c79ce887029", "eventTime": "2018-04-17T21:52:00Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3df30091-e80d-416c-ab8f-8584cc5f1321", "record_id": "flaws_cloudtrail:0000357:3df30091-e80d-416c-ab8f-8584cc5f1321", "row_index": 357, "timestamp": "2018-04-17T21:52:01Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3df30091-e80d-416c-ab8f-8584cc5f1321", "eventTime": "2018-04-17T21:52:01Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4d3e44e8-08af-4d3b-9c1e-44922a2ec314", "record_id": "flaws_cloudtrail:0000358:4d3e44e8-08af-4d3b-9c1e-44922a2ec314", "row_index": 358, "timestamp": "2018-04-17T21:52:02Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1827, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4d3e44e8-08af-4d3b-9c1e-44922a2ec314", "eventTime": "2018-04-17T21:52:02Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: wIMtF0oHnWZ-Mn9FDsMSK6W-zMocVk-C2otIHxv7_3aKbGa-QeVTEJn-zruHa1UukDyRakNgkRX6qu-ExsxVzifeTSiNUfEJaeM9cMJQhNbiqfdXViir4LgVGXLoXkYTXzWgkzSFNvsacGfv76XzLbOjSWYFEp-WqShJJWwSBJtR1VFAcxkUaEYYXZSDvdCQ2TfhvjtnMWJV-9prDjbzEmGX-TczlLmBvwTOQJbgXLkWQwUVpJaB3grffIxSU7T8MD7D7vgIU3wCtxx4BwRcqrevwah6xFdJr7OfGnuLJeEgMYG-6bMVh6lZpMjQNQ_B7suNZ_EWQdCNG-eBDpOwhjLppIovz-22LB5F6rujEXbHIY0OCBCXfJ1CdlNFv0UjORG90lDj1oZYHcrNin-GlLn-Iz13FtptwuH797jkWWenDLUsvL3BlosvZH1h_P0ZsRu7JVWMJ9pGpkyDR1w456hI3nIcHpZQNWs2bODsOZBa66R0qxj7xyuwFGu0h1SN0uVN3ZpF-nUirYzQ29AAtfdf46fM_XuFNV9zjbsp4C3AhNozxxV3eUlxLVTvoWmT71fkD8WNYezieQN6Ta6XWm6_5NeWtSwE83uOOfTUxiTPfD9nIgN3f_vC6x5Uar46VA8UkKvITJjN1zuhUpflX2j-y9Qq-S-Cjg", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "db8707ec-de4e-47ef-a81b-d07c262f08a1", "record_id": "flaws_cloudtrail:0000359:db8707ec-de4e-47ef-a81b-d07c262f08a1", "row_index": 359, "timestamp": "2018-04-17T21:52:02Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "db8707ec-de4e-47ef-a81b-d07c262f08a1", "eventTime": "2018-04-17T21:52:02Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d1a6b897-f1eb-4b2f-849e-9ac9fc9fd91d", "record_id": "flaws_cloudtrail:0000360:d1a6b897-f1eb-4b2f-849e-9ac9fc9fd91d", "row_index": 360, "timestamp": "2018-04-17T21:52:02Z", "event_type": "GetObject", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA4Q57W554H9QCHYEE", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "52.112.191.17", "user_agent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:s3:::prod-data-3674"], "raw_record_size_bytes": 627, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d1a6b897-f1eb-4b2f-849e-9ac9fc9fd91d", "eventTime": "2018-04-17T21:52:02Z", "eventName": "GetObject", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "52.112.191.17", "userAgent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA4Q57W554H9QCHYEE", "userName": "backup"}, "requestParameters": {"bucketName": "prod-data-3674", "key": "customer/05137.json"}, "resources": [{"ARN": "arn:aws:s3:::prod-data-3674"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac736a61-532d-416c-95e6-e090af53b023", "record_id": "flaws_cloudtrail:0000361:ac736a61-532d-416c-95e6-e090af53b023", "row_index": 361, "timestamp": "2018-04-17T21:52:03Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1169, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac736a61-532d-416c-95e6-e090af53b023", "eventTime": "2018-04-17T21:52:03Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8a63d095-5ba8-4085-9f8e-c2524587db4e", "record_id": "flaws_cloudtrail:0000362:8a63d095-5ba8-4085-9f8e-c2524587db4e", "row_index": 362, "timestamp": "2018-04-17T21:52:05Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1827, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8a63d095-5ba8-4085-9f8e-c2524587db4e", "eventTime": "2018-04-17T21:52:05Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: PCZgEyABdp_lhCqKFXWiaQcXT17pMDx1OzICJKqF3u1J_-pTryRH45w0GC97MvdNt9ZcIc9ra2HnljOlw_x74oIqRAOJ9Qx3XudI5nFKs0zbbzWvdmdKHkwbIrZcyU4tUyJ7_RWnqWy6g_pjs1QtKr3JQ0FtatdF3bYHxan0RNxDagidUoFvk8d2jlO_-qKDX1hTLtxBZ80VKigGSkSGkYa_xUq7R6bpKKEnStOzcVk31k0cxSsXJYb07WjhIiL01HvtyokkpHUmwjk4aDtMfxey-4v6GibjO9h2LReNyBO_kCCOp27EZ4cEP2rd2fz38wWo6EekytrTHjMqITdmyQDZhxlmBDEUWiANcuqLvAJSaI5ZaXi-wjjpuVNVHEAOr52xL1a7pd1pb0POSA4fu445z18mnhkIBreIlOxuuEpJLqdiXbIsPnohVLHsMs6ZCUujNnamwtrWEcQ2AygSr99IOoqhPK5ZiahTgDFwBjkGrt_UMCMeq3xg6smtx_dD0NfCttj0o4GbXSiN1dmdHHTKoMSTsR8ilbcFKMVkJUNj0GX9fpwH1gqPCi4fu1BTjqROeTWWkaE7KvM67liPG66uLgyhtvP5dddqQM_V7Tp6L2_RZFenmB0bOzuaZbRhcTJd5kQYt-J_3VzIcJxhom2v7-4FlnFWlwY", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a8dfdd83-720d-41ec-bd6c-9eeb3374684c", "record_id": "flaws_cloudtrail:0000363:a8dfdd83-720d-41ec-bd6c-9eeb3374684c", "row_index": 363, "timestamp": "2018-04-17T21:52:44Z", "event_type": "GetObject", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA4Q57W554H9QCHYEE", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "52.112.191.17", "user_agent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:s3:::prod-data-3674"], "raw_record_size_bytes": 627, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a8dfdd83-720d-41ec-bd6c-9eeb3374684c", "eventTime": "2018-04-17T21:52:44Z", "eventName": "GetObject", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "52.112.191.17", "userAgent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA4Q57W554H9QCHYEE", "userName": "backup"}, "requestParameters": {"bucketName": "prod-data-3674", "key": "customer/05809.json"}, "resources": [{"ARN": "arn:aws:s3:::prod-data-3674"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c481f423-212b-4b6c-b6b1-8ab217e1313a", "record_id": "flaws_cloudtrail:0000364:c481f423-212b-4b6c-b6b1-8ab217e1313a", "row_index": 364, "timestamp": "2018-04-17T21:53:42Z", "event_type": "GetObject", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA4Q57W554H9QCHYEE", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "52.112.191.17", "user_agent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:s3:::prod-data-3674"], "raw_record_size_bytes": 627, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c481f423-212b-4b6c-b6b1-8ab217e1313a", "eventTime": "2018-04-17T21:53:42Z", "eventName": "GetObject", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "52.112.191.17", "userAgent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA4Q57W554H9QCHYEE", "userName": "backup"}, "requestParameters": {"bucketName": "prod-data-3674", "key": "customer/00302.json"}, "resources": [{"ARN": "arn:aws:s3:::prod-data-3674"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "06ee7959-9022-4059-bf36-703971ef17cc", "record_id": "flaws_cloudtrail:0000365:06ee7959-9022-4059-bf36-703971ef17cc", "row_index": 365, "timestamp": "2018-04-17T21:53:57Z", "event_type": "GetObject", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA4Q57W554H9QCHYEE", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "52.112.191.17", "user_agent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:s3:::prod-data-3674"], "raw_record_size_bytes": 627, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "06ee7959-9022-4059-bf36-703971ef17cc", "eventTime": "2018-04-17T21:53:57Z", "eventName": "GetObject", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "52.112.191.17", "userAgent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA4Q57W554H9QCHYEE", "userName": "backup"}, "requestParameters": {"bucketName": "prod-data-3674", "key": "customer/02686.json"}, "resources": [{"ARN": "arn:aws:s3:::prod-data-3674"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e6cb3990-2045-411d-bb7f-9a4b7be48b31", "record_id": "flaws_cloudtrail:0000366:e6cb3990-2045-411d-bb7f-9a4b7be48b31", "row_index": 366, "timestamp": "2018-04-17T21:57:31Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1489, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e6cb3990-2045-411d-bb7f-9a4b7be48b31", "eventTime": "2018-04-17T21:57:31Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAQ0V6T8Q1JS6SLWKJ", "expiration": "Apr 18, 2018 4:01:10 AM", "sessionToken": "FQoDYXdzEK///////////wEaDDmKmLp4neF53+MTISK3A212h8Tx5pbn56Tmg659Z0O7lB8pEBnF7fR6z7RjajQs3qvPbC3pJchvo7oC54ruAMgsNBqYsMkfObFaDFdPobiv4DMVAorj20t7EtZVoSgirb+GwRrr5Z35kZ/p11KWrSaGDFaNM5xu2tb/Z1s1xKWmEjPo19p4iqJcQNV7jpcEsZYlZrUFZHvO/Xv2xyl45EEqgqlJ/OC8ohKm3i8r7JXEtW8k8q4X7JMSdcOWKMnx8jEm/eZZvJWkq2u0nRYVTzNkz7ac744FKUEs/oPuSi6P2k6RYxaKdXXARw5o9lGATpK5P8ujZv/VNivd8nVulMTLpgpoNzcdEuE5wbFIUuS0t96PPMviUB7KMKpIosezZCBXlSPJdEGaothw0mfaU43oKeYt0IUxBhk3z6wz5quNJDE52QPLPKDaBRFv4a7dar168uRfJHXikc14K7AmV8TXWzoT/MY7aVq+MxvRmpxE8FYXEOr4ADMwKpme+mpnRjXHPa2EUAQf2uQgg/Se4/oviwZDWiL9yBB0LIONI7sgDmKFDQv8/hOD3h3fEw8V2XN6hRmTjJlRFKwFXbZQ2h8GxkY8UQIoy9vZ1gU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3a4a05b3-e51f-434f-98ed-f964432f7636", "record_id": "flaws_cloudtrail:0000367:3a4a05b3-e51f-434f-98ed-f964432f7636", "row_index": 367, "timestamp": "2018-04-17T22:02:51Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 776, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3a4a05b3-e51f-434f-98ed-f964432f7636", "eventTime": "2018-04-17T22:02:51Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "af3bb507-6690-4b21-a079-04affbd38b6f", "record_id": "flaws_cloudtrail:0000368:af3bb507-6690-4b21-a079-04affbd38b6f", "row_index": 368, "timestamp": "2018-04-17T22:02:52Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 814, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "af3bb507-6690-4b21-a079-04affbd38b6f", "eventTime": "2018-04-17T22:02:52Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9ed3bf78-0f99-4d3e-926b-4afe609e8d07", "record_id": "flaws_cloudtrail:0000369:9ed3bf78-0f99-4d3e-926b-4afe609e8d07", "row_index": 369, "timestamp": "2018-04-17T22:02:52Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 814, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9ed3bf78-0f99-4d3e-926b-4afe609e8d07", "eventTime": "2018-04-17T22:02:52Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ccb6448-57a8-44ac-90ae-a18063cb8c44", "record_id": "flaws_cloudtrail:0000370:7ccb6448-57a8-44ac-90ae-a18063cb8c44", "row_index": 370, "timestamp": "2018-04-17T22:02:52Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ccb6448-57a8-44ac-90ae-a18063cb8c44", "eventTime": "2018-04-17T22:02:52Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dd18f541-183d-422d-8a75-2a1b21d262a6", "record_id": "flaws_cloudtrail:0000371:dd18f541-183d-422d-8a75-2a1b21d262a6", "row_index": 371, "timestamp": "2018-04-17T22:02:53Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dd18f541-183d-422d-8a75-2a1b21d262a6", "eventTime": "2018-04-17T22:02:53Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d215df63-7ca3-4a08-86c5-cb5ec25c659b", "record_id": "flaws_cloudtrail:0000372:d215df63-7ca3-4a08-86c5-cb5ec25c659b", "row_index": 372, "timestamp": "2018-04-17T22:02:53Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d215df63-7ca3-4a08-86c5-cb5ec25c659b", "eventTime": "2018-04-17T22:02:53Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "50048-bbed-426e-9b55-ddd61f93707b", "record_id": "flaws_cloudtrail:0000373:50048-bbed-426e-9b55-ddd61f93707b", "row_index": 373, "timestamp": "2018-04-17T22:02:53Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 805, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "50048-bbed-426e-9b55-ddd61f93707b", "eventTime": "2018-04-17T22:02:53Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fcb9cd93-b24d-4dde-865c-d52e984ff9b5", "record_id": "flaws_cloudtrail:0000374:fcb9cd93-b24d-4dde-865c-d52e984ff9b5", "row_index": 374, "timestamp": "2018-04-17T22:02:56Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fcb9cd93-b24d-4dde-865c-d52e984ff9b5", "eventTime": "2018-04-17T22:02:56Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a7864e8f-b7e8-4f5b-8476-5a33057bae52", "record_id": "flaws_cloudtrail:0000375:a7864e8f-b7e8-4f5b-8476-5a33057bae52", "row_index": 375, "timestamp": "2018-04-17T22:02:56Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a7864e8f-b7e8-4f5b-8476-5a33057bae52", "eventTime": "2018-04-17T22:02:56Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ab0a23fe-8ae2-41b1-8dea-0bd93b8457db", "record_id": "flaws_cloudtrail:0000376:ab0a23fe-8ae2-41b1-8dea-0bd93b8457db", "row_index": 376, "timestamp": "2018-04-17T22:02:56Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ab0a23fe-8ae2-41b1-8dea-0bd93b8457db", "eventTime": "2018-04-17T22:02:56Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "804446-4003-4f86-b23f-3f0f7ef22cee", "record_id": "flaws_cloudtrail:0000377:804446-4003-4f86-b23f-3f0f7ef22cee", "row_index": 377, "timestamp": "2018-04-17T22:02:56Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "804446-4003-4f86-b23f-3f0f7ef22cee", "eventTime": "2018-04-17T22:02:56Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fb11ad4d-f192-4050-a6a2-53e84e45bc89", "record_id": "flaws_cloudtrail:0000378:fb11ad4d-f192-4050-a6a2-53e84e45bc89", "row_index": 378, "timestamp": "2018-04-17T22:02:57Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fb11ad4d-f192-4050-a6a2-53e84e45bc89", "eventTime": "2018-04-17T22:02:57Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bd7766f5-f6f8-4197-8699-aa0c582222c94", "record_id": "flaws_cloudtrail:0000379:bd7766f5-f6f8-4197-8699-aa0c582222c94", "row_index": 379, "timestamp": "2018-04-17T22:02:57Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bd7766f5-f6f8-4197-8699-aa0c582222c94", "eventTime": "2018-04-17T22:02:57Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7c506442-a4a2-48ea-b45c-dee4a4376dd2", "record_id": "flaws_cloudtrail:0000380:7c506442-a4a2-48ea-b45c-dee4a4376dd2", "row_index": 380, "timestamp": "2018-04-17T22:02:57Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7c506442-a4a2-48ea-b45c-dee4a4376dd2", "eventTime": "2018-04-17T22:02:57Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "db2fb50e-477f-4b12-844d-fb9e82c50679", "record_id": "flaws_cloudtrail:0000381:db2fb50e-477f-4b12-844d-fb9e82c50679", "row_index": 381, "timestamp": "2018-04-17T22:02:58Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "db2fb50e-477f-4b12-844d-fb9e82c50679", "eventTime": "2018-04-17T22:02:58Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b3995c06-de63-44a1-992d-3d1c526303be", "record_id": "flaws_cloudtrail:0000382:b3995c06-de63-44a1-992d-3d1c526303be", "row_index": 382, "timestamp": "2018-04-17T22:02:58Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b3995c06-de63-44a1-992d-3d1c526303be", "eventTime": "2018-04-17T22:02:58Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "db23b0b2-1b5f-4eda-9f31-03695fadc080", "record_id": "flaws_cloudtrail:0000383:db23b0b2-1b5f-4eda-9f31-03695fadc080", "row_index": 383, "timestamp": "2018-04-17T22:02:58Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "db23b0b2-1b5f-4eda-9f31-03695fadc080", "eventTime": "2018-04-17T22:02:58Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b079e149-7017-4016-9524-0bf37fd354bd", "record_id": "flaws_cloudtrail:0000384:b079e149-7017-4016-9524-0bf37fd354bd", "row_index": 384, "timestamp": "2018-04-17T22:02:58Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b079e149-7017-4016-9524-0bf37fd354bd", "eventTime": "2018-04-17T22:02:58Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6f76f398-5621-4c04-a229-21fc7e4f8883", "record_id": "flaws_cloudtrail:0000385:6f76f398-5621-4c04-a229-21fc7e4f8883", "row_index": 385, "timestamp": "2018-04-17T22:02:58Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6f76f398-5621-4c04-a229-21fc7e4f8883", "eventTime": "2018-04-17T22:02:58Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "504fe7f0-97e5-4936-b42a-a580ceb944f2", "record_id": "flaws_cloudtrail:0000386:504fe7f0-97e5-4936-b42a-a580ceb944f2", "row_index": 386, "timestamp": "2018-04-17T22:02:59Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1283, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "504fe7f0-97e5-4936-b42a-a580ceb944f2", "eventTime": "2018-04-17T22:02:59Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b8700f54-78e4-40cf-b209-9ddb9d261e7e", "record_id": "flaws_cloudtrail:0000387:b8700f54-78e4-40cf-b209-9ddb9d261e7e", "row_index": 387, "timestamp": "2018-04-17T22:02:59Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b8700f54-78e4-40cf-b209-9ddb9d261e7e", "eventTime": "2018-04-17T22:02:59Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6c3d95e0-f1db-4ac8-a8ff-580d60018fd9", "record_id": "flaws_cloudtrail:0000388:6c3d95e0-f1db-4ac8-a8ff-580d60018fd9", "row_index": 388, "timestamp": "2018-04-17T22:02:59Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1280, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6c3d95e0-f1db-4ac8-a8ff-580d60018fd9", "eventTime": "2018-04-17T22:02:59Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "defbd5c3-49e4-4f83-a21b-585da189d450", "record_id": "flaws_cloudtrail:0000389:defbd5c3-49e4-4f83-a21b-585da189d450", "row_index": 389, "timestamp": "2018-04-17T22:02:59Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "defbd5c3-49e4-4f83-a21b-585da189d450", "eventTime": "2018-04-17T22:02:59Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "73b886433-5732-42ee-9f15-d2d336107bd1", "record_id": "flaws_cloudtrail:0000390:73b886433-5732-42ee-9f15-d2d336107bd1", "row_index": 390, "timestamp": "2018-04-17T22:02:59Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "73b886433-5732-42ee-9f15-d2d336107bd1", "eventTime": "2018-04-17T22:02:59Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "055182b34-a254-421b-aa50-6834a461a70e", "record_id": "flaws_cloudtrail:0000391:055182b34-a254-421b-aa50-6834a461a70e", "row_index": 391, "timestamp": "2018-04-17T22:02:59Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1171, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "055182b34-a254-421b-aa50-6834a461a70e", "eventTime": "2018-04-17T22:02:59Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "433b95a5-3d5a-4f81-82aa-734946a71709", "record_id": "flaws_cloudtrail:0000392:433b95a5-3d5a-4f81-82aa-734946a71709", "row_index": 392, "timestamp": "2018-04-17T22:02:59Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "433b95a5-3d5a-4f81-82aa-734946a71709", "eventTime": "2018-04-17T22:02:59Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6f9c0ac4-c0cd-490b-86c8-61c1164d9acf", "record_id": "flaws_cloudtrail:0000393:6f9c0ac4-c0cd-490b-86c8-61c1164d9acf", "row_index": 393, "timestamp": "2018-04-17T22:03:00Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6f9c0ac4-c0cd-490b-86c8-61c1164d9acf", "eventTime": "2018-04-17T22:03:00Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6dad6e61-08a3-4c9d-9999-0dfc5a84593d", "record_id": "flaws_cloudtrail:0000394:6dad6e61-08a3-4c9d-9999-0dfc5a84593d", "row_index": 394, "timestamp": "2018-04-17T22:03:00Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1283, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6dad6e61-08a3-4c9d-9999-0dfc5a84593d", "eventTime": "2018-04-17T22:03:00Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2572c0c7-1fc9-4fbd-bbc8-06a927629d", "record_id": "flaws_cloudtrail:0000395:2572c0c7-1fc9-4fbd-bbc8-06a927629d", "row_index": 395, "timestamp": "2018-04-17T22:03:00Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1174, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2572c0c7-1fc9-4fbd-bbc8-06a927629d", "eventTime": "2018-04-17T22:03:00Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "27d22dc6-a6f2-41ff-b9bc-1ff4f7518746", "record_id": "flaws_cloudtrail:0000396:27d22dc6-a6f2-41ff-b9bc-1ff4f7518746", "row_index": 396, "timestamp": "2018-04-17T22:03:00Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "27d22dc6-a6f2-41ff-b9bc-1ff4f7518746", "eventTime": "2018-04-17T22:03:00Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6b52b20a-fdbd-489d-a7fb-907edd0086d8", "record_id": "flaws_cloudtrail:0000397:6b52b20a-fdbd-489d-a7fb-907edd0086d8", "row_index": 397, "timestamp": "2018-04-17T22:03:00Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1275, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6b52b20a-fdbd-489d-a7fb-907edd0086d8", "eventTime": "2018-04-17T22:03:00Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c4dd7358-de1b-4097-924e-7058b72c509e", "record_id": "flaws_cloudtrail:0000398:c4dd7358-de1b-4097-924e-7058b72c509e", "row_index": 398, "timestamp": "2018-04-17T22:03:00Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1171, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c4dd7358-de1b-4097-924e-7058b72c509e", "eventTime": "2018-04-17T22:03:00Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cf6aba84-79f0-4867-a675-afc13f317c6f", "record_id": "flaws_cloudtrail:0000399:cf6aba84-79f0-4867-a675-afc13f317c6f", "row_index": 399, "timestamp": "2018-04-17T22:03:01Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1838, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cf6aba84-79f0-4867-a675-afc13f317c6f", "eventTime": "2018-04-17T22:03:01Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: PrNrNolXwZKljtPUrwYLXkn6LmmYKQs-9DTpiYzf1php8UKrlO0lumY-WYRw0Zl0Rg9rBUrstVkzFZapA_8zVdB4kgd5zkod_0091bVf9IZcRg2G0kPfeTTUKu1BEcyG8dzKPJXmAXOVAFt4gZgV5JIn9HSkXIIv6QLoSEuyLanHJK_Cf91HnLMCEn-wogKKq-e-uy7Zsj_yN-wfmnjcNtbLz1Kp-pfsqLlrLGG190OfFwiM6wcCY958oTgwyVhYFJYDWX6TuQeqanfNXOUmSdbnblFYUSdyt6sGzFm8BarJfqzplewBHA_ba6WIgmwB01JdtVbAIOrbVOcnzJQ3Sir8LL4VuFKohTb0OfMtWyB5dQgO0fFwdvEfMC1WJNKLCqlQNDl5GreyDn-99NUEcokpZzXRDT0y839x1RipAS9N8rKQQbXQwIIcsJP5fvvDqrprqrWLFINAL5UrafZ7How_fnOj1Gd7xGsJPKq1Ezty2zP6w0f3MdoTkWh82oeFRlbrAZtI9b8rr45ZCCTlQg-g2dq4gA-qsAV8-_1PpmI0AaGck1CbALomqTlGbngnSjLLeORmrOPwrnsZx4dtumFG9_CiZlhyQ5JXI1veDFmhX-ikTzyRFgUY_dT0oufWGffKPevwQvolDGBPw3r-f0uE5ajM3OwHqmpk3AvJ", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9e07ffa5-1e25-426f-b93b-8fc910b7ccb5", "record_id": "flaws_cloudtrail:0000400:9e07ffa5-1e25-426f-b93b-8fc910b7ccb5", "row_index": 400, "timestamp": "2018-04-17T22:03:01Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1838, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9e07ffa5-1e25-426f-b93b-8fc910b7ccb5", "eventTime": "2018-04-17T22:03:01Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: uRAiFYAtxZJa-s8MDOalAmZp5Z_hRdqa_VDqPOs2cjEwt9mQIO_y4iodExQk1XmDu_LnbtVTSqWlfrd0SopcmwclkGlCzI5cc5newZ86nIoqOVx70bXLig7i4gpQCgKv91rcOhHH0gNvjkXO-nYh-ov7GsEVLPK9hjQ5vvtRuTL-Nf7RbX_7KTdxeBJWUHLEWLXKgFuOopzOXcwOzakSXOANoMa4S7mCxI6Sac_CtaoECJCA8aqaUFzl9Uw_WDT7SXYlGGafq8yCSpqxxWrhVEh7gJUp07mYfriXh21yntjIEZbU9HwfP48oo8grJa2qRWwmS0JnhAjykZBHyttZRFrAQ7xXtd0KwjRu4-I52XGKyV_tMJ671QmENg_eh1ewJgdFs2zRkg7AGJdWfJKVET4aH-D7KGoVhyMn7w0opjZewZER3Ak1MaSBK6cIomzJI3L8-W1CpkvMpglnzgVah4YTEte80uTan81pvbrjqPZ1tmEfvq0WubNwWB4jgWXS7c-s9tyiCa3cEaB9Rl8a9CRHWBwZnsaAFFHFMYLVq56xi7jY8iFU5N8LYlGQHN5guu-s8_tF68iCzdVLG3LGQdyW4lPIOr6fmm2amdafyI_r7FiEzS9cj99pHj_j5qwcbcjy1ZzMk9rzO0BIVxJHsppDTfpwT20RZzkk3sEq", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d38fbc6d-b038-4780-b594-82acea0cd361", "record_id": "flaws_cloudtrail:0000401:d38fbc6d-b038-4780-b594-82acea0cd361", "row_index": 401, "timestamp": "2018-04-17T22:03:01Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1828, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d38fbc6d-b038-4780-b594-82acea0cd361", "eventTime": "2018-04-17T22:03:01Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: TOv6vII5aZqggSKmIPpDSD-FHyyMAOHWt1SsbEXKe6G-xTCsYQsMvzqevQxRy9dVpjg0sQHCtwUg2VGMCnDSMOJftzaZHcou3uwGndyQOEs35O1k51mDYjh_JNxy0eDkDKVW_G0a49wKMgUKWZWWvLf395j7ONotoHLS4k1dRPb3ljaw3KJopD6FNUChkjNlMgMru7ecZFDlJ8smBUeUfuQonxXYVUmqxD3H96boqUsXIFRsfCivOR2RNjb-XwgFRo_2YkpBF5j_qchWjkUKEB9PyFaHpskRIk_oaVN_NiyKGbtYV0chAxd2sUss1YDri9ApwVgRAlXup1F19AvY0gyuoEJetVAF_y4-VyOkdc6Mpc6OBFnid0PI05Jm9vKIdzmvpSM2C-S7pyKumgwc5AlF4I5oNjKYULOVzyXsKfHgxoysXy8IfQc4oB3R8hq-EmLKRY5q6DXNljaE5qlNETRyBLYVaLsIDQgjR4dSkwoqF4Z5Q7lAcY0Lmc4tr6Zv7pDJEE7nlzr61JI7_pOKxFW5T3iAXxanYcJ0rmYpoBoSPXgMwD7OtEaZATL6wGHTykKa57BmHXEhI54OTcGmGBsbUzlfT_HlvL1sYiyACG4YQpEzqOnDIurQsUI5CAbgERlSVbvp6i9IJmhBKe-VZZ7S_q8uPYlqG8M", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d20da72f-5e8f-4888-bfc7-556a34d54ea0", "record_id": "flaws_cloudtrail:0000402:d20da72f-5e8f-4888-bfc7-556a34d54ea0", "row_index": 402, "timestamp": "2018-04-17T22:03:02Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 813, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d20da72f-5e8f-4888-bfc7-556a34d54ea0", "eventTime": "2018-04-17T22:03:02Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "540c4029-1ec9-44ee-889d-da62482eb628", "record_id": "flaws_cloudtrail:0000403:540c4029-1ec9-44ee-889d-da62482eb628", "row_index": 403, "timestamp": "2018-04-17T22:03:02Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 813, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "540c4029-1ec9-44ee-889d-da62482eb628", "eventTime": "2018-04-17T22:03:02Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "65591d7c-9cf4-4381-99cb-1b45a98d0e58", "record_id": "flaws_cloudtrail:0000404:65591d7c-9cf4-4381-99cb-1b45a98d0e58", "row_index": 404, "timestamp": "2018-04-17T22:03:02Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 812, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "65591d7c-9cf4-4381-99cb-1b45a98d0e58", "eventTime": "2018-04-17T22:03:02Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "58245a4-db41-4ead-97af-83eace337280", "record_id": "flaws_cloudtrail:0000405:58245a4-db41-4ead-97af-83eace337280", "row_index": 405, "timestamp": "2018-04-17T22:03:02Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1276, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "58245a4-db41-4ead-97af-83eace337280", "eventTime": "2018-04-17T22:03:02Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "302f9cac-5de7-4886-8cda-267f24757528", "record_id": "flaws_cloudtrail:0000406:302f9cac-5de7-4886-8cda-267f24757528", "row_index": 406, "timestamp": "2018-04-17T22:03:02Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "302f9cac-5de7-4886-8cda-267f24757528", "eventTime": "2018-04-17T22:03:02Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "27c7ff94-5583-4e20-8e7e-8f5fe7f6c74f", "record_id": "flaws_cloudtrail:0000407:27c7ff94-5583-4e20-8e7e-8f5fe7f6c74f", "row_index": 407, "timestamp": "2018-04-17T22:03:03Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1276, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "27c7ff94-5583-4e20-8e7e-8f5fe7f6c74f", "eventTime": "2018-04-17T22:03:03Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "88164a-8e15-4ab8-9018-4f0ee609c432", "record_id": "flaws_cloudtrail:0000408:88164a-8e15-4ab8-9018-4f0ee609c432", "row_index": 408, "timestamp": "2018-04-17T22:03:03Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1275, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "88164a-8e15-4ab8-9018-4f0ee609c432", "eventTime": "2018-04-17T22:03:03Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1376c9a5-b017-454d-aacb-411b5c9d1778", "record_id": "flaws_cloudtrail:0000409:1376c9a5-b017-454d-aacb-411b5c9d1778", "row_index": 409, "timestamp": "2018-04-17T22:03:05Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1376c9a5-b017-454d-aacb-411b5c9d1778", "eventTime": "2018-04-17T22:03:05Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ed07298-bfdf-4bcb-96e9-b35346d5", "record_id": "flaws_cloudtrail:0000410:ed07298-bfdf-4bcb-96e9-b35346d5", "row_index": 410, "timestamp": "2018-04-17T22:03:05Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1166, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ed07298-bfdf-4bcb-96e9-b35346d5", "eventTime": "2018-04-17T22:03:05Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c990260e1-ed00-4f29-bc13-00319a646002c", "record_id": "flaws_cloudtrail:0000411:c990260e1-ed00-4f29-bc13-00319a646002c", "row_index": 411, "timestamp": "2018-04-17T22:03:05Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1829, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c990260e1-ed00-4f29-bc13-00319a646002c", "eventTime": "2018-04-17T22:03:05Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 2T4SaY1OTJr0BmditjuryTBwZDfFprC_lcrEuxOGCT78aP-ORq_uIlw_xvH_1n611htAWhyrgApYcEZh9MOmO0YEvEPtfS8A_6L7LVjwneVXOPtqKebUfK0M3goMyLmu_4BhZD4KajESMQYSQYFqVqUEdn2uT67Ty7u411W1YjB8xbCc8mGHSa4pjMB1T2hObaNhEW9XNT1e-irMb4o1T3QNUmPH9Yie9Po2zHYHMgqugDBHEeSffuNzhmJRpSErXkuqYalOZ82LeUZaVOQRtBtKbeTBBvJ0yRLMLIqASvYxi2OSdJX_Kn622T5_p1U4BEP6GqlzLySOchpqiVIrsHCAgimcOfxC6EeEX3hl_wKzI-x2b-ueB_enkfq22FQmJtmhdjtW_sWW-SVdm_3W353fJDvnY-TAwnTAGzdbpzJdfcoZVBj5FeneY_ye3FdOHY4Kj0WeAJwMjvi4QxAZRdv_WabiakmsEdPnAkhuLS7Nh8C_eTokXYPXQjR1Ok6UmH-onAVNhE0cNDUKbwi6XM3U9smXFqVnJeyxsYxNfsseBFPazwavfrxv7lpwgB2Lz-_M0puXnB8k_tYTzxvSgolgOMZ-Ulxe_e23vSvCLuD8ULScQdu9hqlWFBmTPWWYoOaRR9lU8PQBnIDoQfb5a6uYCDJ5k3NPgg", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d105c216-30ac-4321-bdd0-c145c3c2df5d", "record_id": "flaws_cloudtrail:0000412:d105c216-30ac-4321-bdd0-c145c3c2df5d", "row_index": 412, "timestamp": "2018-04-17T22:03:05Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d105c216-30ac-4321-bdd0-c145c3c2df5d", "eventTime": "2018-04-17T22:03:05Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c86a098-7f50-49cb-97e5-3dd3be3c9e2d", "record_id": "flaws_cloudtrail:0000413:8c86a098-7f50-49cb-97e5-3dd3be3c9e2d", "row_index": 413, "timestamp": "2018-04-17T22:03:06Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c86a098-7f50-49cb-97e5-3dd3be3c9e2d", "eventTime": "2018-04-17T22:03:06Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9275b698-d47f-418f-9edc-f4d64f48379a", "record_id": "flaws_cloudtrail:0000414:9275b698-d47f-418f-9edc-f4d64f48379a", "row_index": 414, "timestamp": "2018-04-17T22:03:06Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9275b698-d47f-418f-9edc-f4d64f48379a", "eventTime": "2018-04-17T22:03:06Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "032e62f1-8e0c-4616-b4cf-f449e3674867", "record_id": "flaws_cloudtrail:0000415:032e62f1-8e0c-4616-b4cf-f449e3674867", "row_index": 415, "timestamp": "2018-04-17T22:03:06Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "032e62f1-8e0c-4616-b4cf-f449e3674867", "eventTime": "2018-04-17T22:03:06Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2f111b71-b4f6-4463-aa5a-3b82f1a4d327", "record_id": "flaws_cloudtrail:0000416:2f111b71-b4f6-4463-aa5a-3b82f1a4d327", "row_index": 416, "timestamp": "2018-04-17T22:03:07Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2f111b71-b4f6-4463-aa5a-3b82f1a4d327", "eventTime": "2018-04-17T22:03:07Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7b4c3a42-2c6b-4a9f-8df0-cd55b407771", "record_id": "flaws_cloudtrail:0000417:7b4c3a42-2c6b-4a9f-8df0-cd55b407771", "row_index": 417, "timestamp": "2018-04-17T22:03:07Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7b4c3a42-2c6b-4a9f-8df0-cd55b407771", "eventTime": "2018-04-17T22:03:07Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f5bd44a6-0ad8-4ef6-96b8-160084a8ad", "record_id": "flaws_cloudtrail:0000418:f5bd44a6-0ad8-4ef6-96b8-160084a8ad", "row_index": 418, "timestamp": "2018-04-17T22:03:07Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f5bd44a6-0ad8-4ef6-96b8-160084a8ad", "eventTime": "2018-04-17T22:03:07Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ea571e5f-6c39-490f-800d-b6ca14f390aa", "record_id": "flaws_cloudtrail:0000419:ea571e5f-6c39-490f-800d-b6ca14f390aa", "row_index": 419, "timestamp": "2018-04-17T22:03:07Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ea571e5f-6c39-490f-800d-b6ca14f390aa", "eventTime": "2018-04-17T22:03:07Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "09afd6c6-f8bb-41dc-a344-2edcd7006c14", "record_id": "flaws_cloudtrail:0000420:09afd6c6-f8bb-41dc-a344-2edcd7006c14", "row_index": 420, "timestamp": "2018-04-17T22:03:07Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1828, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "09afd6c6-f8bb-41dc-a344-2edcd7006c14", "eventTime": "2018-04-17T22:03:07Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: hhxZRwDStkbgKtoP1AlVWRVTimY_n3dAJ020539hHiB4d0PJ3TacCSiuKjtpIhpZuLaq8AAylyn1TGveFfhnDGMJIVV7yjrL3eCCaLW_uJVz_IsZkg99RSsm3ZREZHlyyyPA7-Jwnv0b_rWWxVygvhNw0wBC07to1cwTo5dJCtPxoN4Cj1As-urxbVdUvC3kfayPunbsRXXaiaR8qrmYhBlmtEBN-h7YB9UQRY7OlnsFVpcSJQ3DbIIDXxWqRYFvgHjWYoUzsbuSX3MsF4DdtyFelfX7OI08sPL5ynrRTXC_iSn2kQXiTfzAHtqC9Gx4JBXa19iRsGrw07D9jRFeHKoKgexajX9NZ0oSzJ5kJy3j6n_IO6yccLohiyr1t5UEWUmXjJYeiMxA8erpGPYq2EzyL9hubDl27Wses53EEND76sfjufSDX24HilmJ-UF91qCA37TJWyFp51lR3H__EoXU7mX4lLErYEbRFO-XiS8ww6vhoJWQ1q-Rh02d6wVCeXJ8G_qXVwnlGhq4pFurwshmTYP79oRjprL6-OBhmWn8EhyJJzZSPLjuGZaKEXvTth4-JGku3v1GFbBYa_L7OvbWRwxYGSm3iwfM9qjKM9ptj6tlnnO0voMMDn_wl2S71Ke3z4GShzC1Nc3aLYnR_HKAqFppyPd6uUg", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "055eccc0-ea2a-492f-bfad-1fae2c6613c3", "record_id": "flaws_cloudtrail:0000421:055eccc0-ea2a-492f-bfad-1fae2c6613c3", "row_index": 421, "timestamp": "2018-04-17T22:03:08Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "055eccc0-ea2a-492f-bfad-1fae2c6613c3", "eventTime": "2018-04-17T22:03:08Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cf4548c9-37fe-49d2-b075-904bdfad577c", "record_id": "flaws_cloudtrail:0000422:cf4548c9-37fe-49d2-b075-904bdfad577c", "row_index": 422, "timestamp": "2018-04-17T22:03:08Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cf4548c9-37fe-49d2-b075-904bdfad577c", "eventTime": "2018-04-17T22:03:08Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "662e2bfd-328b-498d-a4d2-66e2d037f137", "record_id": "flaws_cloudtrail:0000423:662e2bfd-328b-498d-a4d2-66e2d037f137", "row_index": 423, "timestamp": "2018-04-17T22:03:08Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "662e2bfd-328b-498d-a4d2-66e2d037f137", "eventTime": "2018-04-17T22:03:08Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fccf73a7-b999-44c9-98d4-2b573873f1", "record_id": "flaws_cloudtrail:0000424:fccf73a7-b999-44c9-98d4-2b573873f1", "row_index": 424, "timestamp": "2018-04-17T22:03:08Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 802, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fccf73a7-b999-44c9-98d4-2b573873f1", "eventTime": "2018-04-17T22:03:08Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8cbff0cd-e01c-46b3-9e64-c2896c1dd961", "record_id": "flaws_cloudtrail:0000425:8cbff0cd-e01c-46b3-9e64-c2896c1dd961", "row_index": 425, "timestamp": "2018-04-17T22:03:09Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8cbff0cd-e01c-46b3-9e64-c2896c1dd961", "eventTime": "2018-04-17T22:03:09Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "440c6112-97d2-4138-900c-c9ba9fd83942", "record_id": "flaws_cloudtrail:0000426:440c6112-97d2-4138-900c-c9ba9fd83942", "row_index": 426, "timestamp": "2018-04-17T22:03:09Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1281, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "440c6112-97d2-4138-900c-c9ba9fd83942", "eventTime": "2018-04-17T22:03:09Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c6682e95-e2c6-4172-8f3f-c13c6becca7b", "record_id": "flaws_cloudtrail:0000427:c6682e95-e2c6-4172-8f3f-c13c6becca7b", "row_index": 427, "timestamp": "2018-04-17T22:03:09Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c6682e95-e2c6-4172-8f3f-c13c6becca7b", "eventTime": "2018-04-17T22:03:09Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5c41a91c-8e3a-4a3d-beaa-e3c5b0b7d139", "record_id": "flaws_cloudtrail:0000428:5c41a91c-8e3a-4a3d-beaa-e3c5b0b7d139", "row_index": 428, "timestamp": "2018-04-17T22:03:10Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1173, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5c41a91c-8e3a-4a3d-beaa-e3c5b0b7d139", "eventTime": "2018-04-17T22:03:10Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5a2e68a6-b001-433c-ba11-25047b76ecbb", "record_id": "flaws_cloudtrail:0000429:5a2e68a6-b001-433c-ba11-25047b76ecbb", "row_index": 429, "timestamp": "2018-04-17T22:03:10Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1837, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5a2e68a6-b001-433c-ba11-25047b76ecbb", "eventTime": "2018-04-17T22:03:10Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: KvJH-h5W8I3FSnjbciYBERZR5X_DxGDMZ-TVQ8b16qmG6wzMcCeWVYJWf28-14Fm-Ge9wiYSB7MsD8S-2NBm7GkEAe95ETtibWGlS53sufgQMkmJJX_Mbp8sMDC4E2VJ4w7VA0sIGagPt0F1NwPvcwD6-7KIMpKjBpLjvVgTi25d3NmYUlcW-UkzPJS3Gb8FuYD_hnNl1-GjRMSN_WmqALKZV9EPXAwWsLoY-KifZfC4M-7O-s7B7UJpb871L_6wttVkeXwz_CYWqoocuJpK6t0jEo1Ue4KyNzTwFFwbuAquUyWAGdqu5Iek3J7AZY1vfXqef_4bG4tDG8ms7QrEFPHIO8ej6VPB8MRW-T0RgpnJKxTxfxCvC3HABUPWb94vKUKeOo820pDMOuep_tXnJh9ArWtiTV5jFOPZ3C84m6yLWOmQ2LM1rG-yW5kb2UVKkUPl4KSaeyHQfYa94uVKSzPCRT2WH6oiSSL-e-qsqV1Hc3Jtz47bI_Rtud4o1Q1XlSf6mV4kwY67moHTyD2EfK1bZlXTISoHve1XtXGuA0DRROB1KvvgOnXpHa9Rgt0NV9UQEyvEC1UpuVi9gKWAwz849voSRQXOvKWJ7Ir4i66V5-YAxvf1SpBSEW4e8fFnq_f0yUDldgzHqQ7l6P4L9udcuPEC_yBdHbk_dgY", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eaaf3af7-9a0b-4a49-91e9-46e6901ab125", "record_id": "flaws_cloudtrail:0000430:eaaf3af7-9a0b-4a49-91e9-46e6901ab125", "row_index": 430, "timestamp": "2018-04-17T22:03:10Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eaaf3af7-9a0b-4a49-91e9-46e6901ab125", "eventTime": "2018-04-17T22:03:10Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "37cbf48b-f669-4d69-a30c-5a70aa2936ce", "record_id": "flaws_cloudtrail:0000431:37cbf48b-f669-4d69-a30c-5a70aa2936ce", "row_index": 431, "timestamp": "2018-04-17T22:03:10Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1280, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "37cbf48b-f669-4d69-a30c-5a70aa2936ce", "eventTime": "2018-04-17T22:03:10Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "205e37fc-5e6e-437f-a09e-3ceb36b989fc", "record_id": "flaws_cloudtrail:0000432:205e37fc-5e6e-437f-a09e-3ceb36b989fc", "row_index": 432, "timestamp": "2018-04-17T22:03:10Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "205e37fc-5e6e-437f-a09e-3ceb36b989fc", "eventTime": "2018-04-17T22:03:10Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aebe0b1a-0205-4508-89b6-ac387781c11d9", "record_id": "flaws_cloudtrail:0000433:aebe0b1a-0205-4508-89b6-ac387781c11d9", "row_index": 433, "timestamp": "2018-04-17T22:03:11Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1174, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aebe0b1a-0205-4508-89b6-ac387781c11d9", "eventTime": "2018-04-17T22:03:11Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d267f061-0a64-4945-a0d0-10dcac4c74bb", "record_id": "flaws_cloudtrail:0000434:d267f061-0a64-4945-a0d0-10dcac4c74bb", "row_index": 434, "timestamp": "2018-04-17T22:03:11Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d267f061-0a64-4945-a0d0-10dcac4c74bb", "eventTime": "2018-04-17T22:03:11Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "559a9f15-404f-4c98-a629-74ae2a699d09", "record_id": "flaws_cloudtrail:0000435:559a9f15-404f-4c98-a629-74ae2a699d09", "row_index": 435, "timestamp": "2018-04-17T22:03:12Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "559a9f15-404f-4c98-a629-74ae2a699d09", "eventTime": "2018-04-17T22:03:12Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e31794b9-da74-4851-a30e-4ac2c1364657", "record_id": "flaws_cloudtrail:0000436:e31794b9-da74-4851-a30e-4ac2c1364657", "row_index": 436, "timestamp": "2018-04-17T22:03:12Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1283, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e31794b9-da74-4851-a30e-4ac2c1364657", "eventTime": "2018-04-17T22:03:12Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f518625cf-c171-4ef5-8cc7-8c00738d7665", "record_id": "flaws_cloudtrail:0000437:f518625cf-c171-4ef5-8cc7-8c00738d7665", "row_index": 437, "timestamp": "2018-04-17T22:03:12Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1835, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f518625cf-c171-4ef5-8cc7-8c00738d7665", "eventTime": "2018-04-17T22:03:12Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: vYdeBWmU4kTdkXhRpI6rl63rFgAvFLVh-GkiN3GcOODzJ1YgLhSW8bDwYW3UdakTmyZvhAKECFZxzex6l-MwmEKrIT5xmOgCpy2nTHtSBkF0MQsmIeVIE5UDWXX5TwfFrRKK7krda0_qoJk1RH7CbTRSvFmnYodnhGiMQtjD_NjkpEW5IAycUSTt-ejSHLhzhPXZ26vJri5r6iY2UYs_2GfpbHuaMbpz4j_4Ny_r9HgUF0jRBQj6XdSmGOhWMrRJMofExcNPm7Q3AqxGHLtt5__tPvlSH2sYnjBLTCSassyybbZ6ZNBUbYOtGtYex_Sxjo_-MhFww8-OJl-UN07j9-sprA0YEiE6eIFfV7mXi-3uvW5O81PfIqR2t-3wOdfM1_tLCByZGSvd1WC8rP9QrHWtrMRNspzjPyF1RCOlK4i3qhldVc1RZdSDEZlR4Lxx497ryLGnXndOTPvo3OKSWQNglpXgPxw-PgjB8ohnAo2VBIdWi0c3fGr9LGaYCiVmHYxErFDxxuf3cMYmZkDFoeTcn9mWKBC4li5yX72qecZpmvv9eidfy9KMZY7P_lxMozvweAt3GIUfDVD7LwJ76nwOAyTmlEpnTWpbcxIO-7wQHOMs7MWM73ZCj0ZC5R4eoPpBPJX2zj9l9-2wOqxXS-pB7CUofhfmNjLHOw", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b5acc6d6-af37-4838-b708-dc2d13501fe8", "record_id": "flaws_cloudtrail:0000438:b5acc6d6-af37-4838-b708-dc2d13501fe8", "row_index": 438, "timestamp": "2018-04-17T22:03:12Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b5acc6d6-af37-4838-b708-dc2d13501fe8", "eventTime": "2018-04-17T22:03:12Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a136597bf-2ac7-4cac-ab9b-7a62f6b040fd", "record_id": "flaws_cloudtrail:0000439:a136597bf-2ac7-4cac-ab9b-7a62f6b040fd", "row_index": 439, "timestamp": "2018-04-17T22:03:12Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1279, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a136597bf-2ac7-4cac-ab9b-7a62f6b040fd", "eventTime": "2018-04-17T22:03:12Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7298c43d-6de5-4f71-8e6a-b22b535c64de", "record_id": "flaws_cloudtrail:0000440:7298c43d-6de5-4f71-8e6a-b22b535c64de", "row_index": 440, "timestamp": "2018-04-17T22:03:13Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1838, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7298c43d-6de5-4f71-8e6a-b22b535c64de", "eventTime": "2018-04-17T22:03:13Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: uCBrsmdc7uD3OLcEat6EhgxCzg23KkDgMDECONUBw2m6IskCyng02iSZgcaYy-mlufqTx4Fg6kFSozIVyMvIfJjGSzZX9FpWKjlk3Tluum2OGqGozg7h3nE_OGidn_kriEvYChjYuJa14o2q2GrnVg9uZJX0Vp2s-et3EglMAF_gOMGzMIkGpZECPsoB6gyE_SwGFJ0b2-5Nm2LDVWhSHa774StmBF-26lNjsBVdNldLHqSoUaondly2D0P6F7XfE_bTegYUg2jr4NgbvgKyLWW7_aXdLpq6UMRivCHkP1mJUVsykm51xZa8SR6V-x1i6ZAgDTmmgdUHuSsuk9SefOO5olccnGnHGfjdx1LGzdHMa15w7d2odUhZ0XYVjJSkiYXK5DBTIwviCKfhEC0cTHxZur_smD8Pl0UuSVmDAMH19Ztx4ItnXrrWou-dc6zmXWbJealsQryzNlh05Mqd5VxWq0D_P1O0uybmntzWiSVSbJv8ixlxk1ie_SyvFqNzd1PsbV9xjMDlCHJUywPe-rsmIBbBRCCA0KxOtuIhhOrWo_Vbj-_5UsTrYdgbBoW9GUXumTSiTlP7ZwpJKGfc9LwqPyRb22xUz8nykmos05Csi1g5e1X_r-HoLMMwBJf7DP51_gTxY9afHfEkZiYR8-LEcFaPEJ4FJ1K27Mza", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "54ba5d7e-c16b-4c90-8716-9ca5df5a0eee", "record_id": "flaws_cloudtrail:0000441:54ba5d7e-c16b-4c90-8716-9ca5df5a0eee", "row_index": 441, "timestamp": "2018-04-17T22:03:13Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 813, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "54ba5d7e-c16b-4c90-8716-9ca5df5a0eee", "eventTime": "2018-04-17T22:03:13Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "663ef25c-4306-4b16-806d-abe9b7d64ade", "record_id": "flaws_cloudtrail:0000442:663ef25c-4306-4b16-806d-abe9b7d64ade", "row_index": 442, "timestamp": "2018-04-17T22:03:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "663ef25c-4306-4b16-806d-abe9b7d64ade", "eventTime": "2018-04-17T22:03:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e2b6b6c5-6234-446f-8d78-371e094b8163", "record_id": "flaws_cloudtrail:0000443:e2b6b6c5-6234-446f-8d78-371e094b8163", "row_index": 443, "timestamp": "2018-04-17T22:03:13Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e2b6b6c5-6234-446f-8d78-371e094b8163", "eventTime": "2018-04-17T22:03:13Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1c50db6f-df59-48e8-a2a5-039216a620c04", "record_id": "flaws_cloudtrail:0000444:1c50db6f-df59-48e8-a2a5-039216a620c04", "row_index": 444, "timestamp": "2018-04-17T22:03:14Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1c50db6f-df59-48e8-a2a5-039216a620c04", "eventTime": "2018-04-17T22:03:14Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b637d13f-adcf-4579-9f68-76b812a6f979", "record_id": "flaws_cloudtrail:0000445:b637d13f-adcf-4579-9f68-76b812a6f979", "row_index": 445, "timestamp": "2018-04-17T22:03:14Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b637d13f-adcf-4579-9f68-76b812a6f979", "eventTime": "2018-04-17T22:03:14Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "70b42f21-b6ed-4501-9386-42057de5a", "record_id": "flaws_cloudtrail:0000446:70b42f21-b6ed-4501-9386-42057de5a", "row_index": 446, "timestamp": "2018-04-17T22:03:14Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1273, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "70b42f21-b6ed-4501-9386-42057de5a", "eventTime": "2018-04-17T22:03:14Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "95cc7356-6b78-432a-a33e-ca656d995333", "record_id": "flaws_cloudtrail:0000447:95cc7356-6b78-432a-a33e-ca656d995333", "row_index": 447, "timestamp": "2018-04-17T22:03:15Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1276, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "95cc7356-6b78-432a-a33e-ca656d995333", "eventTime": "2018-04-17T22:03:15Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f4ad5865-d326-4403-b100-99f04546e", "record_id": "flaws_cloudtrail:0000448:f4ad5865-d326-4403-b100-99f04546e", "row_index": 448, "timestamp": "2018-04-17T22:03:15Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1825, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f4ad5865-d326-4403-b100-99f04546e", "eventTime": "2018-04-17T22:03:15Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 8TrHhDmWiZNum4oZF5ODjPJNJ3O4hPXlw6xtlyCJSQuNwZnaDfW0FFKav4bytM2HnbHvIf05p_Kiew7d9ScuddNfMjdoCupxYh2eLlfYCDCMEci0gHLzaiEwPYkTA46SpuX-xSO3kOJp49ZBy7kjOvSd_7GwYpz7gUEp8fBchBAwaYvKUwNacroIT70fQeVK1-PDjoZT9IUIEc_Z_69EyvENcIpx1M_sBtTjaDlkBdWTP8pV4CT1SEPUfbW0m_c5eFHwJA7GliBcm9XOa-9oyT4L1BvK8jYe11XM8hRmHQJkKyXP6EPtzGAfS0_4CVo7-3FVOFplJi0BMGMt54wrfzkut673cIHKg8vNsaOmphniSLDjjNImRVdOPV8Qf4NlblRD1-Z6XyIyutrHCdnV52i25hXRIX70JBj9X3fUxi5W5NUcojTq5mO6Np10L04uAUa5wqzQ-F9pbtb9Ztxu838kwTW3ZP-WuK9ercPKV4u7MUteJ3WC7OlD2LjRjXEvuH4vYUeTLtBw0Wg-70JTP26KrTY5ILOjn-pnycCyt8nFHGB-Qa4ekhF9IHamDyhVu66DGcZmF_6bmnaVm2gyiP7VgmYwxVHOKIIThYSdYPMEKBiabahSHTCUqtI1hZi0IbC1vIjKuDtqq_Bnk3noOnEC5JRr1nMtZfM", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4dfe4a62-ef3f-4c5c-8736-d6976ea92e3e", "record_id": "flaws_cloudtrail:0000449:4dfe4a62-ef3f-4c5c-8736-d6976ea92e3e", "row_index": 449, "timestamp": "2018-04-17T22:03:16Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4dfe4a62-ef3f-4c5c-8736-d6976ea92e3e", "eventTime": "2018-04-17T22:03:16Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9e3f65e8-5254-4948-b709-116bc6ed8325", "record_id": "flaws_cloudtrail:0000450:9e3f65e8-5254-4948-b709-116bc6ed8325", "row_index": 450, "timestamp": "2018-04-17T22:03:16Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9e3f65e8-5254-4948-b709-116bc6ed8325", "eventTime": "2018-04-17T22:03:16Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a506371e7-c240-4c30-addd-9f4df0935508", "record_id": "flaws_cloudtrail:0000451:a506371e7-c240-4c30-addd-9f4df0935508", "row_index": 451, "timestamp": "2018-04-17T22:03:16Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a506371e7-c240-4c30-addd-9f4df0935508", "eventTime": "2018-04-17T22:03:16Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4653f609-1f5f-441f-80fb-64f011373361", "record_id": "flaws_cloudtrail:0000452:4653f609-1f5f-441f-80fb-64f011373361", "row_index": 452, "timestamp": "2018-04-17T22:03:17Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4653f609-1f5f-441f-80fb-64f011373361", "eventTime": "2018-04-17T22:03:17Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3e651b65-d5c7-4a10-874b-d4ac480ad9f0", "record_id": "flaws_cloudtrail:0000453:3e651b65-d5c7-4a10-874b-d4ac480ad9f0", "row_index": 453, "timestamp": "2018-04-17T22:03:17Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1171, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3e651b65-d5c7-4a10-874b-d4ac480ad9f0", "eventTime": "2018-04-17T22:03:17Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7b64d62e-9fa9-497c-9de1-792fd0474b73", "record_id": "flaws_cloudtrail:0000454:7b64d62e-9fa9-497c-9de1-792fd0474b73", "row_index": 454, "timestamp": "2018-04-17T22:03:18Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7b64d62e-9fa9-497c-9de1-792fd0474b73", "eventTime": "2018-04-17T22:03:18Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f2c6f344-c378-4274-81d1-8c76201ef37f", "record_id": "flaws_cloudtrail:0000455:f2c6f344-c378-4274-81d1-8c76201ef37f", "row_index": 455, "timestamp": "2018-04-17T22:03:18Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f2c6f344-c378-4274-81d1-8c76201ef37f", "eventTime": "2018-04-17T22:03:18Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ba527fd5-dbf2-43c0-b6f7-3c5385f1f4f6", "record_id": "flaws_cloudtrail:0000456:ba527fd5-dbf2-43c0-b6f7-3c5385f1f4f6", "row_index": 456, "timestamp": "2018-04-17T22:03:19Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ba527fd5-dbf2-43c0-b6f7-3c5385f1f4f6", "eventTime": "2018-04-17T22:03:19Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4f5ff14c-5fb7-4f93-bca8-442611b079051", "record_id": "flaws_cloudtrail:0000457:4f5ff14c-5fb7-4f93-bca8-442611b079051", "row_index": 457, "timestamp": "2018-04-17T22:03:19Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4f5ff14c-5fb7-4f93-bca8-442611b079051", "eventTime": "2018-04-17T22:03:19Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e7f65a2a-9826-4d2b-b451-aed984c865b2", "record_id": "flaws_cloudtrail:0000458:e7f65a2a-9826-4d2b-b451-aed984c865b2", "row_index": 458, "timestamp": "2018-04-17T22:03:19Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e7f65a2a-9826-4d2b-b451-aed984c865b2", "eventTime": "2018-04-17T22:03:19Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "94a768c0-c59e-4cb4-ab00-202b9261f31f", "record_id": "flaws_cloudtrail:0000459:94a768c0-c59e-4cb4-ab00-202b9261f31f", "row_index": 459, "timestamp": "2018-04-17T22:03:19Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "94a768c0-c59e-4cb4-ab00-202b9261f31f", "eventTime": "2018-04-17T22:03:19Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "001571e1-b7be-44fb-97a6-fcf65eebe304", "record_id": "flaws_cloudtrail:0000460:001571e1-b7be-44fb-97a6-fcf65eebe304", "row_index": 460, "timestamp": "2018-04-17T22:03:19Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1828, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "001571e1-b7be-44fb-97a6-fcf65eebe304", "eventTime": "2018-04-17T22:03:19Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: z6jVaiaqezB7NesBR_g7ljtfIGqUDrTG8NPPH-o5zFu-WavrHHkr5OE4OWlVaff4J6lwPpHSewIJqmm8M-M4DbuSYhoxWFAy7g9hi3K56hOj-xyfJynu-1u6lT99CjXxj8bPOT9a-P0tZ28UkpK34qZ5k4YKvTv784Qirgb-uSoGyTbBUFJjb_3utVW5WSHcQF-GXPmop6nbNp4KUYWmPfLHDa9NnMCeKhxyuIiOelN3v3bl27WQCiwBl_1rJCSLkqeG0CLp99BPxJO1uXilCAH0fTyF7Fpax4SNzlpbIm_6xtsRUW7O3x2hfapXooCUy7BpBdmOH8_i1kMc3peX1P4VJU4q3McBLKPw2RBJZMx7uLois-PcV8JhfE0P74MhcDF7PHgIJcfcaNm0FuPs3mRnNMDUmKkzEz4gXjhbAlbrli5XBy4QqjlBoueJl1ECCYJFYNYmlVO7tfhAkXzAgXIKax28XL79nj9brue08-a_IudApJZ9eRboHnIIvllQAmF_1TKEgg8m85AOBqzUdAqq916DnbaM_zXxsjitfNiRHV5Znw3fDUPXcPbzqX1zUt9vdqnhUe3bdwGo5zjmh4t7dB7kjyO407jQC903GNjzCeHMyE6vH4KEaHRO7uQCjbMUrkTGf4VkEtcaSowk5sEbJueNeqjp74c", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "89660e3d-8743-4406-93ae-690cd9e95ce0", "record_id": "flaws_cloudtrail:0000461:89660e3d-8743-4406-93ae-690cd9e95ce0", "row_index": 461, "timestamp": "2018-04-17T22:03:20Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "89660e3d-8743-4406-93ae-690cd9e95ce0", "eventTime": "2018-04-17T22:03:20Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "94913-3726-4202-9031-7fbd541e5957", "record_id": "flaws_cloudtrail:0000462:94913-3726-4202-9031-7fbd541e5957", "row_index": 462, "timestamp": "2018-04-17T22:03:20Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "94913-3726-4202-9031-7fbd541e5957", "eventTime": "2018-04-17T22:03:20Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ef79a7ca-88af-474f-b9e4-6e45e424b2f7", "record_id": "flaws_cloudtrail:0000463:ef79a7ca-88af-474f-b9e4-6e45e424b2f7", "row_index": 463, "timestamp": "2018-04-17T22:03:20Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ef79a7ca-88af-474f-b9e4-6e45e424b2f7", "eventTime": "2018-04-17T22:03:20Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9549f89d-07d6-4747-a283-bde07e5e34e3", "record_id": "flaws_cloudtrail:0000464:9549f89d-07d6-4747-a283-bde07e5e34e3", "row_index": 464, "timestamp": "2018-04-17T22:03:20Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9549f89d-07d6-4747-a283-bde07e5e34e3", "eventTime": "2018-04-17T22:03:20Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f4707edc-0164-469f-b404-b5246cd14781", "record_id": "flaws_cloudtrail:0000465:f4707edc-0164-469f-b404-b5246cd14781", "row_index": 465, "timestamp": "2018-04-17T22:03:20Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f4707edc-0164-469f-b404-b5246cd14781", "eventTime": "2018-04-17T22:03:20Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3f1a8410-e787-4857-a4ff-07c742846a03", "record_id": "flaws_cloudtrail:0000466:3f1a8410-e787-4857-a4ff-07c742846a03", "row_index": 466, "timestamp": "2018-04-17T22:03:21Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1280, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3f1a8410-e787-4857-a4ff-07c742846a03", "eventTime": "2018-04-17T22:03:21Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cb780d02-af73-4bca-b09a-b2f7ba518dd3", "record_id": "flaws_cloudtrail:0000467:cb780d02-af73-4bca-b09a-b2f7ba518dd3", "row_index": 467, "timestamp": "2018-04-17T22:03:22Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cb780d02-af73-4bca-b09a-b2f7ba518dd3", "eventTime": "2018-04-17T22:03:22Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "42fe6aec-2c26-4068-9a20-0ee98917d839", "record_id": "flaws_cloudtrail:0000468:42fe6aec-2c26-4068-9a20-0ee98917d839", "row_index": 468, "timestamp": "2018-04-17T22:03:22Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1280, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "42fe6aec-2c26-4068-9a20-0ee98917d839", "eventTime": "2018-04-17T22:03:22Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "70d64c48-7087-4eb8-acd5-716bad5f4582", "record_id": "flaws_cloudtrail:0000469:70d64c48-7087-4eb8-acd5-716bad5f4582", "row_index": 469, "timestamp": "2018-04-17T22:03:22Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "70d64c48-7087-4eb8-acd5-716bad5f4582", "eventTime": "2018-04-17T22:03:22Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0b53d41a-482f-41a5-ad99-e4c6ac92804d", "record_id": "flaws_cloudtrail:0000470:0b53d41a-482f-41a5-ad99-e4c6ac92804d", "row_index": 470, "timestamp": "2018-04-17T22:03:22Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0b53d41a-482f-41a5-ad99-e4c6ac92804d", "eventTime": "2018-04-17T22:03:22Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ccd231f2-cb11-43b3-ab4d-685b701d336d", "record_id": "flaws_cloudtrail:0000471:ccd231f2-cb11-43b3-ab4d-685b701d336d", "row_index": 471, "timestamp": "2018-04-17T22:03:23Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ccd231f2-cb11-43b3-ab4d-685b701d336d", "eventTime": "2018-04-17T22:03:23Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ea0383f7-87b7-44f3-afc1-89bd248cfa0d", "record_id": "flaws_cloudtrail:0000472:ea0383f7-87b7-44f3-afc1-89bd248cfa0d", "row_index": 472, "timestamp": "2018-04-17T22:03:23Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ea0383f7-87b7-44f3-afc1-89bd248cfa0d", "eventTime": "2018-04-17T22:03:23Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "39f4a2a1-327b-4537-814f-2eec10254ab1", "record_id": "flaws_cloudtrail:0000473:39f4a2a1-327b-4537-814f-2eec10254ab1", "row_index": 473, "timestamp": "2018-04-17T22:03:24Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1171, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "39f4a2a1-327b-4537-814f-2eec10254ab1", "eventTime": "2018-04-17T22:03:24Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a594e16f-3771-49a1-9171-388f57912ceb", "record_id": "flaws_cloudtrail:0000474:a594e16f-3771-49a1-9171-388f57912ceb", "row_index": 474, "timestamp": "2018-04-17T22:03:24Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1173, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a594e16f-3771-49a1-9171-388f57912ceb", "eventTime": "2018-04-17T22:03:24Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6bee168b-0494-4c6a-ad04-99ab011a7e71", "record_id": "flaws_cloudtrail:0000475:6bee168b-0494-4c6a-ad04-99ab011a7e71", "row_index": 475, "timestamp": "2018-04-17T22:03:24Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1828, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6bee168b-0494-4c6a-ad04-99ab011a7e71", "eventTime": "2018-04-17T22:03:24Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: u3k3-QLTOZ0CKbVKTYxaaP7t8I7AiUc3y5LI0CZTXwgrOtYP-le11GVrwvyPS4tpJqg8afiTV3eD0Lpcnui1m1tr3eXyacIvGiWbanJ2CpyszmcqUzgpvxECBo1LJ8oASfujRe3sWSlX8_H-AyHRbAkgat2Dsu9bKNPlzTV4x7As9If1doGRyCKcZFC3wZwYjDFKpXrN2A7byptmHXFwnr2ALrmjsB5a7Xlmmx4FAhAYbXQobQ9T-WPjSZnY43a6u3ytdLwXd3IFz-gbGTfqgtSMZEDsQY0MWuWkJsNycRtAQ7p4w6k5W30mcav_TvjYZAyXybclj5q_z-4AUEGbRAhrR0L5IKmedhVr0CNBcLNcgxL2ATxAzHPQ3JHQnoXHChQq0yn-16asKZokaYBNxjrRFjzoAWwg17BrEVI_IZJum4FfurpbWzByl34jU0RiUifZeu4JdDFKCJmHcG53WQ4Awra5Isx87BnLqoisCpnrgb6U7S4LrngcUJ39YJQOi9XubTqzda_RSEF_oDgUkKfESuMZDDLjpK2_pznAUEJs-KDIoZsv3xjzBPx0pI0zmvqzTE57PASzBwSKVhlQMLL8lkZ6H764XRgYOofCiFZAUSADY6Um6juKk0biCnNG3WTMfTsENhP4AobgRxfV8iVRhsNPR65HiwU", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "099d473e-eb4e-4e6e-b596-51713ac6", "record_id": "flaws_cloudtrail:0000476:099d473e-eb4e-4e6e-b596-51713ac6", "row_index": 476, "timestamp": "2018-04-17T22:03:24Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1273, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "099d473e-eb4e-4e6e-b596-51713ac6", "eventTime": "2018-04-17T22:03:24Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "51dc0dd5-71ca-4f47-93ed-e881b2dc84af", "record_id": "flaws_cloudtrail:0000477:51dc0dd5-71ca-4f47-93ed-e881b2dc84af", "row_index": 477, "timestamp": "2018-04-17T22:03:24Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "51dc0dd5-71ca-4f47-93ed-e881b2dc84af", "eventTime": "2018-04-17T22:03:24Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "904729-cd97-4831-a95a-57e18c289794", "record_id": "flaws_cloudtrail:0000478:904729-cd97-4831-a95a-57e18c289794", "row_index": 478, "timestamp": "2018-04-17T22:03:25Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1829, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "904729-cd97-4831-a95a-57e18c289794", "eventTime": "2018-04-17T22:03:25Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: lK1nq5XrIyYVkm3lstekJv2OZxreNsqUMnQgy68yRlYjlIEvDh-Z5qH3eFgLo6yKO9hVjA-Bsd9O2sqrz_-2YJ1WGzAQBLEjGj39bS7QEMm4UBVkhRkAfb5VUt4q2XEkWy6yD92P0BjLKRnyAhhSEz-5VnWfu1-d193gzBpwzIWhurUg3gIS-2Se7EYZEODT97QQm-IPGFv6jSCqaLzQdXwmk5kApMQWU3V48RN5qoMBVKGCD1U5EkJfELMEvZIyuthQKpPMBZmJx7MRMfzgkVhrZHUm4Jzl0XgTHeCQZ-2BL5E9y7hFUjDxx7wasbO_Kl7PUDB4PJGM3bfOend--0HusPRKA0adrkJfmoVyKaADkcOvHFcOzb7OiWJNoOJn5mZgPD8nPK8TCqbag_U1T4qJtve4zaWok7aoK3j32uV0__duyF_WqedjzEFB4Ny1heGtQI9v8ovxp4UQ5Fd-9aiceCmGiWHCJokfDm27pDSa_IxXql05SfOUdNv4KlYB0wGMSlbtgDnGyC0dw15C3AWFNHQbErAdjYCHRP6Q6pLuj4T1F0fm029zaV-Co6JKQ9Q_jWID2CDOmSXSrZPDu-AAyut5RCs8xRv0M9WkVCP4SUkyVbJ71GRoTOZr2aFMjv5Ja2O7Ipz3yJodgvmKm1eMnSLfSBT1e2mN", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "026a4c0f-228f-4aa5-b11b-978ee710f3ab", "record_id": "flaws_cloudtrail:0000479:026a4c0f-228f-4aa5-b11b-978ee710f3ab", "row_index": 479, "timestamp": "2018-04-17T22:03:25Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1832, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "026a4c0f-228f-4aa5-b11b-978ee710f3ab", "eventTime": "2018-04-17T22:03:25Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: I-PhOqxWpvck43q6Y0EcY65DR0K0qHue_3oefyJDXomqFNwqcrB3qVfokLy92-2bydB1_ZbmoP4YrQyEVOQeFVkddf-b0u0RYt6B9hONQhfZQI1GvMeXD5EuuwxaqrUtzYHlxY-hlc-0IJxxmqqvAECRJp5ftcQd7MtG0brnmmxFCQ1qYb54z1S837K33_9CteM1ZqpoAu_B7w7NIuSiCLzAAFhJqzPQe7GhvRGhhRU3sbiKNFx4s7N2dt58HMkU6l9pPAjX6pLc2Hi7smScRwvaYpwMCpStT5xbIyvXl2WicTH4mgnp-ovlAuAzphGaheD29_jLBg4ELnVD9oQ9Prb-MF9QKBjYUq2ZwWHddp-579iXRLTJx_GDQcUBh-m6GnPKvIeCbVVKBrjwXY6SxQuY9cTkQZ1bZBAyq_SvBjvcROLRdihFniNRGHBfJj5kI6BSwGXNH4WZCUzAnXp56FIPR2f76pOqjCrNp-nZo2w6dNbahsWbe-ZoL4BR6zkHBHBQh4pxk6megovMPJCYWuYNOk-yFBQZ3F8ZIIot7XvqTdwP1dWpAucc1-M0dp0pNUBQw8LXWYVDp2I7wndoM0-11iXIlC3ycuCx96t_CKd9-xSx-q6w47uZxXeHkt7ddsXf4ET3hJbxJLrdtDogOrTQixve9uh8V1nj", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dcb025cb-344f-4a32-982c-87cf43eb9628", "record_id": "flaws_cloudtrail:0000480:dcb025cb-344f-4a32-982c-87cf43eb9628", "row_index": 480, "timestamp": "2018-04-17T22:03:25Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dcb025cb-344f-4a32-982c-87cf43eb9628", "eventTime": "2018-04-17T22:03:25Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d4379a84-fa6d-4ebf-9fa1-fde9c83ddd63", "record_id": "flaws_cloudtrail:0000481:d4379a84-fa6d-4ebf-9fa1-fde9c83ddd63", "row_index": 481, "timestamp": "2018-04-17T22:03:26Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1276, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d4379a84-fa6d-4ebf-9fa1-fde9c83ddd63", "eventTime": "2018-04-17T22:03:26Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4afd6cc7-c08c-48b6-b8ac-52be733880f3", "record_id": "flaws_cloudtrail:0000482:4afd6cc7-c08c-48b6-b8ac-52be733880f3", "row_index": 482, "timestamp": "2018-04-17T22:03:26Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4afd6cc7-c08c-48b6-b8ac-52be733880f3", "eventTime": "2018-04-17T22:03:26Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8505c402-9c63-4d2e-942e-c48c4fe0f5f1", "record_id": "flaws_cloudtrail:0000483:8505c402-9c63-4d2e-942e-c48c4fe0f5f1", "row_index": 483, "timestamp": "2018-04-17T22:03:27Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1171, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8505c402-9c63-4d2e-942e-c48c4fe0f5f1", "eventTime": "2018-04-17T22:03:27Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a24e313c-8b80-4fd3-bd4d-35d80e8db68c", "record_id": "flaws_cloudtrail:0000484:a24e313c-8b80-4fd3-bd4d-35d80e8db68c", "row_index": 484, "timestamp": "2018-04-17T22:03:28Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a24e313c-8b80-4fd3-bd4d-35d80e8db68c", "eventTime": "2018-04-17T22:03:28Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "10ace776-cd56-41c2-a6eb-78e992eb332d", "record_id": "flaws_cloudtrail:0000485:10ace776-cd56-41c2-a6eb-78e992eb332d", "row_index": 485, "timestamp": "2018-04-17T22:03:29Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1826, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "10ace776-cd56-41c2-a6eb-78e992eb332d", "eventTime": "2018-04-17T22:03:29Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 09G050ad8sfdI9yv-0EomazfJnphWfIE92GAR23JvvibZZsVgQPvi2ZmKbZQCja4njmSoQ8qW7CJngWox3nwnpQVFEMA01snQ2MjvdZORHjZVAnnihoz0tSh8Xf7Z2ztaBh3tSfExJzefhQDX2QiyYMfMm2rA1zrM0Xb-u6KyYgjft4nv_snbhOJTT2w4BKO9zauthttiWDqTOnyfb2WzfcmFH84_P7DR2paWQrDBgwBKEIp_Vb4O4HMO5dbxp9zEsdGE1_ZnrNOsg967JlgUg6GEMZdAzvgB7qQdVi734rToLNZnwSajQSrNvHSRjtoJsZvv6r_xABMEPtnOjCzUCFT8P92_2MxTvox-EYp_A2vJ3Rr6yOH1jne5X7QFnr2kgQ94K_MyZHAOlV5lswu6Fy9Of2Xbpp1C0CSfFIFvYxZBVW0DlxfqPhN9fQC1HSg7mXiK8LlMZpTgEJE73x4tspnrQx9QUrAFJlTq6RNnGxgTKL0QNlVmLXLEKjlQx9Xvwflu2zcrGl3ABWN9LzWmBu4wEb3BfLxc_4YwRDSwUr8KolOUgU_78AKTKXcgSKX-LgyBAfg-rXm8qGHpaH1k8h2JGQk9S8U4tGHJFfPJUTrgVdcNQln1mumyhboegPZEyjIWRGddnK1-Sjwc3rkdgpFpBBiF1RgSg", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f96d6407-1f2d-4ab4-a15c-5fbecfbe032a", "record_id": "flaws_cloudtrail:0000486:f96d6407-1f2d-4ab4-a15c-5fbecfbe032a", "row_index": 486, "timestamp": "2018-04-17T22:03:29Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f96d6407-1f2d-4ab4-a15c-5fbecfbe032a", "eventTime": "2018-04-17T22:03:29Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "653fc8bf-5a35-40cc-88ba-bfc6d92fafb4", "record_id": "flaws_cloudtrail:0000487:653fc8bf-5a35-40cc-88ba-bfc6d92fafb4", "row_index": 487, "timestamp": "2018-04-17T22:03:31Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1171, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "653fc8bf-5a35-40cc-88ba-bfc6d92fafb4", "eventTime": "2018-04-17T22:03:31Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "746e16d3-ed86-4335-aeac-476d76f1e5ea", "record_id": "flaws_cloudtrail:0000488:746e16d3-ed86-4335-aeac-476d76f1e5ea", "row_index": 488, "timestamp": "2018-04-17T22:03:32Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1828, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "746e16d3-ed86-4335-aeac-476d76f1e5ea", "eventTime": "2018-04-17T22:03:32Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: Kqlep1H1l5BrxROsrcHus6OKRVacTLu5Gt-OlHds7FytFfqja-QCWJ5O-Vbev-BpTLanQbBT8pej2lHUXfL0aXGCcy9vxf4DlPzmY5MlPmi0X5-wT43ZkSNMaD38kC-D5F4yz1bBnh7R9WAPs7gR-dRdoNqZFmR68LBsa88hROXafmp93SWMdVsJKVD6pg6-GS_vkPzLySMngsaCLY80ArJkqYrPTKq5s6vvNxvWkeaPgvxaAexa27CX4scPQGED6pyroBgtEp15BiWDtpFZj6uNUJQAESshNdnDvvDvLtPpa141cuslb-LT57RAE8yQQt4w_3tH2A1uChilDRH0m1uFrVMv0BQxxONdVhG5z9AWkQiVwqVNTbnXrLwRf_Slj-EgAKRdi7bY6J4Y_VoEss9CqNP6zIs2cpXWmIe9P9zIa-ub685TG8kg-RCH5JWjiryogIXMf7fRBxleIXKxBBP1kXPMF5koNkU9yYlkkR1krPkVih41Ks75rJkxiDQ6HQvKxDDwcuihRtBLYMoec1oYN_BI27wK03vPxjBv_2LNJ05uKqjmGaC61elTBFHoTWdwvWb2H2W0WYWb4-0dfihqAOYNJr4y1xNspj8UhsqJpZLWtrMp2sIt_Pp8UfGxEGXmxknr02C52yXtrF2SOfn2B5zkd80Z6ZU", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0bc30c38-1c7c-46f9-ba19-c34bb80a3e8b", "record_id": "flaws_cloudtrail:0000489:0bc30c38-1c7c-46f9-ba19-c34bb80a3e8b", "row_index": 489, "timestamp": "2018-04-17T22:14:21Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 776, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0bc30c38-1c7c-46f9-ba19-c34bb80a3e8b", "eventTime": "2018-04-17T22:14:21Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0529c039-4b21-4440-b022-8aa5ab1b5f06", "record_id": "flaws_cloudtrail:0000490:0529c039-4b21-4440-b022-8aa5ab1b5f06", "row_index": 490, "timestamp": "2018-04-17T22:14:24Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 814, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0529c039-4b21-4440-b022-8aa5ab1b5f06", "eventTime": "2018-04-17T22:14:24Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "290243aa9-0a26-4c10-825f-30d752d7708a", "record_id": "flaws_cloudtrail:0000491:290243aa9-0a26-4c10-825f-30d752d7708a", "row_index": 491, "timestamp": "2018-04-17T22:14:24Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 815, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "290243aa9-0a26-4c10-825f-30d752d7708a", "eventTime": "2018-04-17T22:14:24Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fef4ddfe-be62-4012-82df-7fa5179882c9", "record_id": "flaws_cloudtrail:0000492:fef4ddfe-be62-4012-82df-7fa5179882c9", "row_index": 492, "timestamp": "2018-04-17T22:14:24Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fef4ddfe-be62-4012-82df-7fa5179882c9", "eventTime": "2018-04-17T22:14:24Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "03ad71ca-1eeb-43d9-b01f-9c30a714065a", "record_id": "flaws_cloudtrail:0000493:03ad71ca-1eeb-43d9-b01f-9c30a714065a", "row_index": 493, "timestamp": "2018-04-17T22:14:25Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "03ad71ca-1eeb-43d9-b01f-9c30a714065a", "eventTime": "2018-04-17T22:14:25Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "beb229b4-003d-4863-9464-e77aeb7cd5cb", "record_id": "flaws_cloudtrail:0000494:beb229b4-003d-4863-9464-e77aeb7cd5cb", "row_index": 494, "timestamp": "2018-04-17T22:14:25Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "beb229b4-003d-4863-9464-e77aeb7cd5cb", "eventTime": "2018-04-17T22:14:25Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ea1c7c9-7211-4aa0-a90f-83fe92e0876f", "record_id": "flaws_cloudtrail:0000495:7ea1c7c9-7211-4aa0-a90f-83fe92e0876f", "row_index": 495, "timestamp": "2018-04-17T22:14:25Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ea1c7c9-7211-4aa0-a90f-83fe92e0876f", "eventTime": "2018-04-17T22:14:25Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8bfeceab-706c-4ca8-888a-878d089d95e3", "record_id": "flaws_cloudtrail:0000496:8bfeceab-706c-4ca8-888a-878d089d95e3", "row_index": 496, "timestamp": "2018-04-17T22:14:28Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8bfeceab-706c-4ca8-888a-878d089d95e3", "eventTime": "2018-04-17T22:14:28Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "76fddb43-c39f-4ced-9ae3-555260c3b37", "record_id": "flaws_cloudtrail:0000497:76fddb43-c39f-4ced-9ae3-555260c3b37", "row_index": 497, "timestamp": "2018-04-17T22:14:28Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "76fddb43-c39f-4ced-9ae3-555260c3b37", "eventTime": "2018-04-17T22:14:28Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e69b8666-77de-4786-b8f4-6dad102fd8b6", "record_id": "flaws_cloudtrail:0000498:e69b8666-77de-4786-b8f4-6dad102fd8b6", "row_index": 498, "timestamp": "2018-04-17T22:14:28Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e69b8666-77de-4786-b8f4-6dad102fd8b6", "eventTime": "2018-04-17T22:14:28Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f68ba486-7fda-4974-a9b0-94cb96bad0f8", "record_id": "flaws_cloudtrail:0000499:f68ba486-7fda-4974-a9b0-94cb96bad0f8", "row_index": 499, "timestamp": "2018-04-17T22:14:28Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f68ba486-7fda-4974-a9b0-94cb96bad0f8", "eventTime": "2018-04-17T22:14:28Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "393d3f30-f640-4f47-9478-4d07a3de0cdd", "record_id": "flaws_cloudtrail:0000500:393d3f30-f640-4f47-9478-4d07a3de0cdd", "row_index": 500, "timestamp": "2018-04-17T22:14:28Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "393d3f30-f640-4f47-9478-4d07a3de0cdd", "eventTime": "2018-04-17T22:14:28Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4db66150-43a3-4da7-8e22-4034adcceee6", "record_id": "flaws_cloudtrail:0000501:4db66150-43a3-4da7-8e22-4034adcceee6", "row_index": 501, "timestamp": "2018-04-17T22:14:28Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4db66150-43a3-4da7-8e22-4034adcceee6", "eventTime": "2018-04-17T22:14:28Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ea06d340-e3aa-44f5-b7f4-561d49d51c63", "record_id": "flaws_cloudtrail:0000502:ea06d340-e3aa-44f5-b7f4-561d49d51c63", "row_index": 502, "timestamp": "2018-04-17T22:14:29Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ea06d340-e3aa-44f5-b7f4-561d49d51c63", "eventTime": "2018-04-17T22:14:29Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8b8ba58b-2324-42c3-bd7d-314b00a64e9a", "record_id": "flaws_cloudtrail:0000503:8b8ba58b-2324-42c3-bd7d-314b00a64e9a", "row_index": 503, "timestamp": "2018-04-17T22:14:29Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8b8ba58b-2324-42c3-bd7d-314b00a64e9a", "eventTime": "2018-04-17T22:14:29Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6f9c7df5-d59b-4396-a6d8-3505f6f2676f", "record_id": "flaws_cloudtrail:0000504:6f9c7df5-d59b-4396-a6d8-3505f6f2676f", "row_index": 504, "timestamp": "2018-04-17T22:14:29Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6f9c7df5-d59b-4396-a6d8-3505f6f2676f", "eventTime": "2018-04-17T22:14:29Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6ba12a13-b412-4628-ac80-0b4532ac7fb6", "record_id": "flaws_cloudtrail:0000505:6ba12a13-b412-4628-ac80-0b4532ac7fb6", "row_index": 505, "timestamp": "2018-04-17T22:14:29Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 699, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6ba12a13-b412-4628-ac80-0b4532ac7fb6", "eventTime": "2018-04-17T22:14:29Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c5a397e4-78ce-4839-a8f2-3fbb344492a0c", "record_id": "flaws_cloudtrail:0000506:c5a397e4-78ce-4839-a8f2-3fbb344492a0c", "row_index": 506, "timestamp": "2018-04-17T22:14:30Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1284, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c5a397e4-78ce-4839-a8f2-3fbb344492a0c", "eventTime": "2018-04-17T22:14:30Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aecb5648-0655-4b22-9125-b1f1fcc7d564", "record_id": "flaws_cloudtrail:0000507:aecb5648-0655-4b22-9125-b1f1fcc7d564", "row_index": 507, "timestamp": "2018-04-17T22:14:30Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1280, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aecb5648-0655-4b22-9125-b1f1fcc7d564", "eventTime": "2018-04-17T22:14:30Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a953b8ac-5ec1-4703-afbc-ee05139fe231", "record_id": "flaws_cloudtrail:0000508:a953b8ac-5ec1-4703-afbc-ee05139fe231", "row_index": 508, "timestamp": "2018-04-17T22:14:30Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1281, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a953b8ac-5ec1-4703-afbc-ee05139fe231", "eventTime": "2018-04-17T22:14:30Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ef93fe3e-31b4-42d3-8799-c07dce9e0336", "record_id": "flaws_cloudtrail:0000509:ef93fe3e-31b4-42d3-8799-c07dce9e0336", "row_index": 509, "timestamp": "2018-04-17T22:14:30Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ef93fe3e-31b4-42d3-8799-c07dce9e0336", "eventTime": "2018-04-17T22:14:30Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4c4b7cc0-c2f3-484f-82c5-6b36cd8579d5", "record_id": "flaws_cloudtrail:0000510:4c4b7cc0-c2f3-484f-82c5-6b36cd8579d5", "row_index": 510, "timestamp": "2018-04-17T22:14:30Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4c4b7cc0-c2f3-484f-82c5-6b36cd8579d5", "eventTime": "2018-04-17T22:14:30Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0f54d783-345c-41c3-be3f-1b53ad51a279", "record_id": "flaws_cloudtrail:0000511:0f54d783-345c-41c3-be3f-1b53ad51a279", "row_index": 511, "timestamp": "2018-04-17T22:14:30Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0f54d783-345c-41c3-be3f-1b53ad51a279", "eventTime": "2018-04-17T22:14:30Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8ed12168-d99e-4388-bd34-42ac0b5a7ebc", "record_id": "flaws_cloudtrail:0000512:8ed12168-d99e-4388-bd34-42ac0b5a7ebc", "row_index": 512, "timestamp": "2018-04-17T22:14:30Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8ed12168-d99e-4388-bd34-42ac0b5a7ebc", "eventTime": "2018-04-17T22:14:30Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf8a7765-642a-4b48-8640-ca247c0ba218", "record_id": "flaws_cloudtrail:0000513:bf8a7765-642a-4b48-8640-ca247c0ba218", "row_index": 513, "timestamp": "2018-04-17T22:14:31Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1838, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf8a7765-642a-4b48-8640-ca247c0ba218", "eventTime": "2018-04-17T22:14:31Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: EanHXdet_ic97H-_zAv7dc_O-Cn3DtjXi1074FdpVDwj38r0lG1tD7KLPPJ1I_6uJfOF2lZiQuSwD4idwEoSb71DST0GbC9ICVPmXONrvf957lO2qnq1tDUyhZ8L1V03cx1e1-xCWTWwriH7CcoJQqvYzxA6YlB3LCE4JdMOoLHTcA7GGPCF3LVBosDhNi42Jvn3tpNl4podpsRQc8aBqCVGZQErGYEPK5POpufmI6iIKCBzr4NBmJatQevNrdbhPaOSHnR0wZMuKRF5P4kruixj_Ij_dbB-u0tOd9VvHkRmsZmatUuz3Lkw_cN-W8HhbWUbmbJHDU9xH-5IVLOJ1IyKp-yrqg9zC44pdT4nfiJ83af30bXLu2rKuioUdPrOWHbQBijQWvAtWETVIIEUiBnL9c4ZO_0VSH0eoRJ1a1XLRHVLXhNrVeS2AAjE8Z75QHkWVTZKkXeBi7r-txFbOiZgkw3tT5ZJh-fd78pu2D7Nk1GAPVKbSqUSzb29DmQbJ90LSdh7iMIJRNzZb0E2OS51d6FG_qMd26l2p6Cjtc0LdZL2N7ntob8od26MMpXhdxjCcHXqozVEoVwPXMIRZ-p1Lcuj_5yQ9lUZqaAIsMMB0ymcOWoDezxwoWTK0Az5vlYSGA1wnBsDrK1yJgAVOUMTmpiHKgdj3qK59G9G", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ca57294", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f6c01081-55c3-459a-b0fe-3d515995c078", "record_id": "flaws_cloudtrail:0000514:f6c01081-55c3-459a-b0fe-3d515995c078", "row_index": 514, "timestamp": "2018-04-17T22:14:31Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1176, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f6c01081-55c3-459a-b0fe-3d515995c078", "eventTime": "2018-04-17T22:14:31Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "30769-9f85-43a8-8269-2842ce09096c", "record_id": "flaws_cloudtrail:0000515:30769-9f85-43a8-8269-2842ce09096c", "row_index": 515, "timestamp": "2018-04-17T22:14:31Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "30769-9f85-43a8-8269-2842ce09096c", "eventTime": "2018-04-17T22:14:31Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "729dd7a2-3177-4bab-93fb-630bb3bf1817", "record_id": "flaws_cloudtrail:0000516:729dd7a2-3177-4bab-93fb-630bb3bf1817", "row_index": 516, "timestamp": "2018-04-17T22:14:31Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "729dd7a2-3177-4bab-93fb-630bb3bf1817", "eventTime": "2018-04-17T22:14:31Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b821fe03-c773-4f8a-a41f-f2fefbac4032", "record_id": "flaws_cloudtrail:0000517:b821fe03-c773-4f8a-a41f-f2fefbac4032", "row_index": 517, "timestamp": "2018-04-17T22:14:31Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1171, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b821fe03-c773-4f8a-a41f-f2fefbac4032", "eventTime": "2018-04-17T22:14:31Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e2ffed84-157a-4878-8566-b1b361106", "record_id": "flaws_cloudtrail:0000518:e2ffed84-157a-4878-8566-b1b361106", "row_index": 518, "timestamp": "2018-04-17T22:14:32Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-northeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1835, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e2ffed84-157a-4878-8566-b1b361106", "eventTime": "2018-04-17T22:14:32Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-northeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: WDgbpS5slga5mX2VQlk-zbZ6JR5zu4zvlLHxe-TMLIG6la0Vmu0s53lgJxOjnVvsKXM1XuGoFNaIVVGNCp_zsoI3LQPr6hTQxeevMbR9o1XsjWTBoS84YNlVo3bvXExRjna6wwtHjRcM2UjXENHdhYa14Ikh_BmL5rZcUnPDVVBNoSnObUzRbzUdj0b9h8wHmwYhvxxoZaPs5_KIKwf63kObvb4IKufLUGhitvBeXtuQ6fUrNuSmLqD-Of4hM7D6yXHt3YURaz8_vYie_h1XfBopRLcTY7ygTcR2bYzos1KKhFAynEysB9MKMnSSNOz-7sTtBiqH90tlzxRvCxXv10w0sWVQBIQS0hqyAbIAugeuWtxB2w3xsRFV3k-znfO2giRhGHFMHgTBgC-Y9ojAi73dCnyN1nWxQn-O0yZsWnYLIk0P_8rZx5j37f6FzJtZ9Kon1DCskknL3vRI58CHKVPaUmX7d9VklbFe38e9ead-N49OnbvQowPJX6lfeiLeCRjca740qmFj6GQbaKc2yUvr8tKrZLeqcd9FCq5_m4mRNi-jhUha7gj1YfZOjd0Y7Z92CKwuXYop4kl3uEBoWXhLmOe0cWOmdhp9zqwblpuICI5iffxJz5ItBg7PZ99Ax58OIcSbRM7XQ2sVG9Ewm85qoyzH4HspvSLuS1hd", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-14f2b3cc", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dc131d84-1007-4474-8955-edf9be206b51", "record_id": "flaws_cloudtrail:0000519:dc131d84-1007-4474-8955-edf9be206b51", "row_index": 519, "timestamp": "2018-04-17T22:14:32Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 814, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dc131d84-1007-4474-8955-edf9be206b51", "eventTime": "2018-04-17T22:14:32Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "710a00d6-bced-4e9c-a3a9-722468a466", "record_id": "flaws_cloudtrail:0000520:710a00d6-bced-4e9c-a3a9-722468a466", "row_index": 520, "timestamp": "2018-04-17T22:14:32Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "710a00d6-bced-4e9c-a3a9-722468a466", "eventTime": "2018-04-17T22:14:32Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a99509-546b-4686-835e-01d4ae824386", "record_id": "flaws_cloudtrail:0000521:a99509-546b-4686-835e-01d4ae824386", "row_index": 521, "timestamp": "2018-04-17T22:14:32Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1275, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a99509-546b-4686-835e-01d4ae824386", "eventTime": "2018-04-17T22:14:32Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "177adbf1-98a8-4c90-ae15-3ea82c8947b7", "record_id": "flaws_cloudtrail:0000522:177adbf1-98a8-4c90-ae15-3ea82c8947b7", "row_index": 522, "timestamp": "2018-04-17T22:14:32Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "177adbf1-98a8-4c90-ae15-3ea82c8947b7", "eventTime": "2018-04-17T22:14:32Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b0cab80c-e015-4de7-85a2-d25e0ae757c7", "record_id": "flaws_cloudtrail:0000523:b0cab80c-e015-4de7-85a2-d25e0ae757c7", "row_index": 523, "timestamp": "2018-04-17T22:14:33Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 812, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b0cab80c-e015-4de7-85a2-d25e0ae757c7", "eventTime": "2018-04-17T22:14:33Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "19f8d490-0fa0-48a1-a228-90c8c02000b", "record_id": "flaws_cloudtrail:0000524:19f8d490-0fa0-48a1-a228-90c8c02000b", "row_index": 524, "timestamp": "2018-04-17T22:14:33Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1274, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "19f8d490-0fa0-48a1-a228-90c8c02000b", "eventTime": "2018-04-17T22:14:33Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eed00734-a2b5-4057-8d51-64768f1f8b5", "record_id": "flaws_cloudtrail:0000525:eed00734-a2b5-4057-8d51-64768f1f8b5", "row_index": 525, "timestamp": "2018-04-17T22:14:33Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1167, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eed00734-a2b5-4057-8d51-64768f1f8b5", "eventTime": "2018-04-17T22:14:33Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fc567c82-c840-4f47-bdaa-481b0e0a2044", "record_id": "flaws_cloudtrail:0000526:fc567c82-c840-4f47-bdaa-481b0e0a2044", "row_index": 526, "timestamp": "2018-04-17T22:14:34Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fc567c82-c840-4f47-bdaa-481b0e0a2044", "eventTime": "2018-04-17T22:14:34Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "73d1bdc3-e7da-4fe5-8bea-c99d9f384006", "record_id": "flaws_cloudtrail:0000527:73d1bdc3-e7da-4fe5-8bea-c99d9f384006", "row_index": 527, "timestamp": "2018-04-17T22:14:34Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1828, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "73d1bdc3-e7da-4fe5-8bea-c99d9f384006", "eventTime": "2018-04-17T22:14:34Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: mR33kjE7heB8GxQaGgQDcsz66LYX2cu2mVjeNT2wO0hbYnmjgjnFa4AnFSWuAsY4fiPD79aTFd2xrNad0mOsmvKLi_nDxcuoydFIu-_oQcyXs6FVDipP10jyzmpEZahLJwaenZN84DYII_oqb-QtsnoivOB2YH38c9skpQ2jEj_whdar7qfCKamRAGYOYTjkIzK-BaC1npFzdzlait9IXND6HB9EnzCtyJQDBwe2hUojW4bT-hn1UB-KvAsSS0o6BnyQOVAOZUmhDvFkPt5CgaEoAFHK3LQXZ_-EBaFcaloXb28TBOETSB8KgpRPDRM6oVUCiXaCgz-3apHfBLy_VkQrOQCqwZ-oFzubPmua-Td4V3JWkjyuEe_bfCda1-NS4uU8ZoHIq0Dm0bD42_p9ut-b5T5wmQPtzhxCDRAN5Kzje56EVLBQLQLe87iT4KJaZ7Oa3DX2tMRxs2IVYW__-6bNcguGygojQLhHh0c1_k6rmHwKvTva9OLlHF3TjfdHrsVXk2JHEz5byvp50-QYVOZh2VZmaqHOSTw8tU9_M4uFN71FmnRUfJbXvEHA-dWCf92qwFtwIs6_FkSfvSRWU2qb6sHsAFduTdQiE16mCDfj7dOTVakbuR-uwRXO1qsE5i5zBc77PHOmgrZuV8bJ_kvKfbmsC4k6UlE", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-f5710223", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e63c2e55-7fa3-4b40-ad24-32a2a157341e", "record_id": "flaws_cloudtrail:0000528:e63c2e55-7fa3-4b40-ad24-32a2a157341e", "row_index": 528, "timestamp": "2018-04-17T22:14:35Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e63c2e55-7fa3-4b40-ad24-32a2a157341e", "eventTime": "2018-04-17T22:14:35Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0c29b496-e9d4-40b0-acad-4bdeedfa8c91", "record_id": "flaws_cloudtrail:0000529:0c29b496-e9d4-40b0-acad-4bdeedfa8c91", "row_index": 529, "timestamp": "2018-04-17T22:14:35Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0c29b496-e9d4-40b0-acad-4bdeedfa8c91", "eventTime": "2018-04-17T22:14:35Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "962a58e0-5667-4e00-b482-aa2c9b73a6d3", "record_id": "flaws_cloudtrail:0000530:962a58e0-5667-4e00-b482-aa2c9b73a6d3", "row_index": 530, "timestamp": "2018-04-17T22:14:36Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "962a58e0-5667-4e00-b482-aa2c9b73a6d3", "eventTime": "2018-04-17T22:14:36Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c9f92efb-9c6e-4ecd-ace1-998864c3b5", "record_id": "flaws_cloudtrail:0000531:c9f92efb-9c6e-4ecd-ace1-998864c3b5", "row_index": 531, "timestamp": "2018-04-17T22:14:36Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1825, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c9f92efb-9c6e-4ecd-ace1-998864c3b5", "eventTime": "2018-04-17T22:14:36Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: wa8DhOhlOT_KaJKKPam44EgVpWLGTW830K3O3rVYtEh8K_q2hMqUkASs_TA5heuGxplWDUygAS8KoBNUTvWvtv2IzsamOG-fQ-V31eZoESOKNXV4CHYZ-punlEN1k0Bv-irxqEyCROXvprW-sQ1N_qaG9IXsLLPQQUYci9zEthOJd9If5UTIzejmLXUup51rCdFxiqa7LiVj7NvdwgcbEBDQaaFq8VbKRnECkSNN0qlnkJHC2uJ4XB1UfnkWtR-uxc2AZWh0UvvZo7Yi98_jOsO_PhSp2kRqNy2Y-R2NCOL9h8x0yFOyWz-zKTNOl5jtdA2MKseVnS3yAlPDrkk2ERjHaLyXo07naIoB2ajiE7rZBiZara1LfQSbeJusiWkLo1j9PEAz3L1yZIVceWA7ZFLPPDrtfm1qjJGXOpoPupRqKg87kjNWJ9SETaQZsoqvQHmnAHlfF9XyhVxJhFZZgSbqZ3m0p87UjcsLJh5JDR5_Szh_6e88RFzw4qnO7ZxsfCXqDOUf8q0xNJBARG4hBRfelvt5hG5rwzQRuXfLn3Y0HwEeFhWaiUiDb5bbeoXAeT4Sk59N1y9iPFg_sOvJV0tEHIlGKsmSgHgg2KaSCekNViJCidT4hiMKEQt3AYp9I3zY-m6TaU6mlW2GqJiu9dS2ydd9ckPeFA", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-7ef6f0d3", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f36ed33e-0dec-47f6-9716-a7e90d5d2da9", "record_id": "flaws_cloudtrail:0000532:f36ed33e-0dec-47f6-9716-a7e90d5d2da9", "row_index": 532, "timestamp": "2018-04-17T22:14:37Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f36ed33e-0dec-47f6-9716-a7e90d5d2da9", "eventTime": "2018-04-17T22:14:37Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "76b08639-6798-48e7-bead-3fccbdb028b0", "record_id": "flaws_cloudtrail:0000533:76b08639-6798-48e7-bead-3fccbdb028b0", "row_index": 533, "timestamp": "2018-04-17T22:14:37Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 814, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "76b08639-6798-48e7-bead-3fccbdb028b0", "eventTime": "2018-04-17T22:14:37Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "13095e3-baea-46c5-8ca9-320fa85df08b", "record_id": "flaws_cloudtrail:0000534:13095e3-baea-46c5-8ca9-320fa85df08b", "row_index": 534, "timestamp": "2018-04-17T22:14:37Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "13095e3-baea-46c5-8ca9-320fa85df08b", "eventTime": "2018-04-17T22:14:37Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "881b1d03-fcaf-4d52-a446-7d62a5ba512f", "record_id": "flaws_cloudtrail:0000535:881b1d03-fcaf-4d52-a446-7d62a5ba512f", "row_index": 535, "timestamp": "2018-04-17T22:14:37Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1171, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "881b1d03-fcaf-4d52-a446-7d62a5ba512f", "eventTime": "2018-04-17T22:14:37Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "98e46ce3-8f03-4230-804c-98570bba33bd", "record_id": "flaws_cloudtrail:0000536:98e46ce3-8f03-4230-804c-98570bba33bd", "row_index": 536, "timestamp": "2018-04-17T22:14:37Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "98e46ce3-8f03-4230-804c-98570bba33bd", "eventTime": "2018-04-17T22:14:37Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bd41035-d9b6-4c98-8482-fbfebcdfd367", "record_id": "flaws_cloudtrail:0000537:bd41035-d9b6-4c98-8482-fbfebcdfd367", "row_index": 537, "timestamp": "2018-04-17T22:14:38Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1279, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bd41035-d9b6-4c98-8482-fbfebcdfd367", "eventTime": "2018-04-17T22:14:38Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eb970dd2-8652-48a9-a89a-8c67054583ec", "record_id": "flaws_cloudtrail:0000538:eb970dd2-8652-48a9-a89a-8c67054583ec", "row_index": 538, "timestamp": "2018-04-17T22:14:38Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eb970dd2-8652-48a9-a89a-8c67054583ec", "eventTime": "2018-04-17T22:14:38Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dd86fd8c-c915-482d-a83e-fc60ff0b594e", "record_id": "flaws_cloudtrail:0000539:dd86fd8c-c915-482d-a83e-fc60ff0b594e", "row_index": 539, "timestamp": "2018-04-17T22:14:38Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dd86fd8c-c915-482d-a83e-fc60ff0b594e", "eventTime": "2018-04-17T22:14:38Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3064b25e-1a9e-4baf-aeaf-bb041739c033", "record_id": "flaws_cloudtrail:0000540:3064b25e-1a9e-4baf-aeaf-bb041739c033", "row_index": 540, "timestamp": "2018-04-17T22:14:39Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1283, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3064b25e-1a9e-4baf-aeaf-bb041739c033", "eventTime": "2018-04-17T22:14:39Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "066319-5fd1-40be-98a8-ddb73a28222", "record_id": "flaws_cloudtrail:0000541:066319-5fd1-40be-98a8-ddb73a28222", "row_index": 541, "timestamp": "2018-04-17T22:14:39Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "066319-5fd1-40be-98a8-ddb73a28222", "eventTime": "2018-04-17T22:14:39Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "57400-a8b7-49ea-b7e6-c7c0123fa009", "record_id": "flaws_cloudtrail:0000542:57400-a8b7-49ea-b7e6-c7c0123fa009", "row_index": 542, "timestamp": "2018-04-17T22:14:39Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "sa-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1825, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "57400-a8b7-49ea-b7e6-c7c0123fa009", "eventTime": "2018-04-17T22:14:39Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "sa-east-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: eBZhDLcWRQIWAvj2eqspazndhZNQf_jmFb-9Siqd5ACq9oSPci8DVCq56gbtB7D9GE01i4j9dnsX3OdQYBGHDdnU9cBUc_OsRGe7ozwcokvyTXm6QIixyaGqzeenf9zJeXiA5d2XgDx1tWQwl49A5Jv9VZSOEqDMvR31foJFazlG2UnGqM0C35afCw05JXDoWE5x_hQQZlO575aEGtjn-_L8Il4cQ9t8NnV01MpXT-qc3UPla6O0FINYbI_OWTcZLlJ7rjOJPrMR3TPVPBTXEhnmX7Ujl5fO7byvdid2ngepCJkyIy4Q92TSX3XtxtJ_tWS_7kwkuuWGvWV9YUkYlaJGNmKFQ33uF8Q618LvWLRJaLzuyaooDx_L-ckEumbCyxqHryXl7KTQLsnZn3rI8MSByHR1Gx4b7ghgsY8fLx3gaSoIWIfV-VcVc8RCDVj30FzlHIbmJ-OOouiJ2Cl7SNdfRVi4B3K4TBAGjq9w2Zvd58c1OAHLyeBrNA94qcgjdLHH_o8c06_WsmHcBJDKlBY4Q76WBMzLLKL3c6R7bYWZG_xAGbpHEjolrFyJ0K3nDsNvaeCczgmK5URnZk1B1eH9tTLB4e_GP_PEIZZxCUoCRH2_zwqE-nIXPR5WcKM5ujMO0mdZXRvepCn0jAFkq1-Hx8aERYFJQHo", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-dc82b8b9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fcf98411-56ac-4d6a-b856-2f6942e135b2", "record_id": "flaws_cloudtrail:0000543:fcf98411-56ac-4d6a-b856-2f6942e135b2", "row_index": 543, "timestamp": "2018-04-17T22:14:40Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1176, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fcf98411-56ac-4d6a-b856-2f6942e135b2", "eventTime": "2018-04-17T22:14:40Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "57b85f58-a17d-4548-bbbe-16fb61f58c3d", "record_id": "flaws_cloudtrail:0000544:57b85f58-a17d-4548-bbbe-16fb61f58c3d", "row_index": 544, "timestamp": "2018-04-17T22:14:40Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "57b85f58-a17d-4548-bbbe-16fb61f58c3d", "eventTime": "2018-04-17T22:14:40Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "717ad9bf-a4c1-4f0e-9362-800a68c1ff5e", "record_id": "flaws_cloudtrail:0000545:717ad9bf-a4c1-4f0e-9362-800a68c1ff5e", "row_index": 545, "timestamp": "2018-04-17T22:14:41Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-1"}, "resource_arns": [], "raw_record_size_bytes": 1838, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "717ad9bf-a4c1-4f0e-9362-800a68c1ff5e", "eventTime": "2018-04-17T22:14:41Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: MSrTs_PdleXnFqUoIlN66SiTe2zWI9xl9Qj1Mu_PgltIRioC7DZ3tiksEv39aqzbee7Pq9CAx85NMk_CpOCc2UkcDw7ku8XOVEc0yVpP_cFAegp9wLPtZKfpLedb8b-vG6w19Ep30CtnWj0csgho5OA7CvlqX7y4i6OO5TuZPfq1OyLra1ChRxj537fr1FZ88aYjdhDQm5a1rtlQ0kDWcXL5IuxHpE237Mwwd-HXvhaKWmOU_SAmtMNDKdwGjxHIPjMNY9Ef2vROF4kjyLwzoFs0M7b8QlHaKieaChV3XY_llTZYg4BtT5YgkCiS5uPqSlPYYFLdD3kDLyT9lYetBLYlXnYKr0tRJoTL30k9eIs2fyF_cWoOBilwWJbaLdxvqkXS9tJw6QVY4jfREnEPK8FiVj2HVXQK7bbOh7rsXdRVeU3i2MtkqYEwmEK71vBrGaWnJ7AApPKIDW8BY0Q_zHn54LAKTq3P_f3puoHhrfF_h287BNhniBayeZ0aFxXCR461eHRgksoyn-1AR7B_x2__pwJHfDOgKvNey9NtwVljpIKY3ATCcLZU1BamVkRLg6xajP2RFp6XrGHv6k9elEt6f_p4B3rVOjVH7_bfcUB_DV872579C2_paqe8VsTWJSL-KslEleYJ1eeEyrS22v-EQoKKwATQ_krG124s", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-546ae567", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3be5a4dc-f562-4f0b-a4b0-5b1b50e9266b", "record_id": "flaws_cloudtrail:0000546:3be5a4dc-f562-4f0b-a4b0-5b1b50e9266b", "row_index": 546, "timestamp": "2018-04-17T22:14:41Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3be5a4dc-f562-4f0b-a4b0-5b1b50e9266b", "eventTime": "2018-04-17T22:14:41Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8a9d834e-3348-4e0b-89de-8d5bb6b17136", "record_id": "flaws_cloudtrail:0000547:8a9d834e-3348-4e0b-89de-8d5bb6b17136", "row_index": 547, "timestamp": "2018-04-17T22:14:41Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8a9d834e-3348-4e0b-89de-8d5bb6b17136", "eventTime": "2018-04-17T22:14:41Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "161c23be-d3a1-486d-a347-8f0900b36177", "record_id": "flaws_cloudtrail:0000548:161c23be-d3a1-486d-a347-8f0900b36177", "row_index": 548, "timestamp": "2018-04-17T22:14:41Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1280, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "161c23be-d3a1-486d-a347-8f0900b36177", "eventTime": "2018-04-17T22:14:41Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c88c05a4-ca83-43ce-ac42-c40502fde", "record_id": "flaws_cloudtrail:0000549:c88c05a4-ca83-43ce-ac42-c40502fde", "row_index": 549, "timestamp": "2018-04-17T22:14:41Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c88c05a4-ca83-43ce-ac42-c40502fde", "eventTime": "2018-04-17T22:14:41Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1a149e80-876b-49da-b791-34ffddf00457", "record_id": "flaws_cloudtrail:0000550:1a149e80-876b-49da-b791-34ffddf00457", "row_index": 550, "timestamp": "2018-04-17T22:14:42Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1a149e80-876b-49da-b791-34ffddf00457", "eventTime": "2018-04-17T22:14:42Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f1e7ecdc-99fe-482e-be16-4e41db8b0b21", "record_id": "flaws_cloudtrail:0000551:f1e7ecdc-99fe-482e-be16-4e41db8b0b21", "row_index": 551, "timestamp": "2018-04-17T22:14:42Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f1e7ecdc-99fe-482e-be16-4e41db8b0b21", "eventTime": "2018-04-17T22:14:42Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "793f411e-3480-4d35-99ca-71a5d9054a05", "record_id": "flaws_cloudtrail:0000552:793f411e-3480-4d35-99ca-71a5d9054a05", "row_index": 552, "timestamp": "2018-04-17T22:14:43Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "793f411e-3480-4d35-99ca-71a5d9054a05", "eventTime": "2018-04-17T22:14:43Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7c91f118-cca0-46fc-8a1d-5b4d12fe5d53", "record_id": "flaws_cloudtrail:0000553:7c91f118-cca0-46fc-8a1d-5b4d12fe5d53", "row_index": 553, "timestamp": "2018-04-17T22:14:43Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7c91f118-cca0-46fc-8a1d-5b4d12fe5d53", "eventTime": "2018-04-17T22:14:43Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "82b24999-c41e-40e5-a1ac-f20eee542d2b", "record_id": "flaws_cloudtrail:0000554:82b24999-c41e-40e5-a1ac-f20eee542d2b", "row_index": 554, "timestamp": "2018-04-17T22:14:43Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1280, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "82b24999-c41e-40e5-a1ac-f20eee542d2b", "eventTime": "2018-04-17T22:14:43Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c4db691c-708e-4e16-940a-8bc4de826121", "record_id": "flaws_cloudtrail:0000555:c4db691c-708e-4e16-940a-8bc4de826121", "row_index": 555, "timestamp": "2018-04-17T22:14:43Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c4db691c-708e-4e16-940a-8bc4de826121", "eventTime": "2018-04-17T22:14:43Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8597b08c-685e-44eb-9a2e-57cd8359d8aa", "record_id": "flaws_cloudtrail:0000556:8597b08c-685e-44eb-9a2e-57cd8359d8aa", "row_index": 556, "timestamp": "2018-04-17T22:14:44Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1282, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8597b08c-685e-44eb-9a2e-57cd8359d8aa", "eventTime": "2018-04-17T22:14:44Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "910ec6c1-feb9-47ed-8100-5a3519e03c18", "record_id": "flaws_cloudtrail:0000557:910ec6c1-feb9-47ed-8100-5a3519e03c18", "row_index": 557, "timestamp": "2018-04-17T22:14:44Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1174, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "910ec6c1-feb9-47ed-8100-5a3519e03c18", "eventTime": "2018-04-17T22:14:44Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2d142b30-990f-4241-84f9-edd76473b", "record_id": "flaws_cloudtrail:0000558:2d142b30-990f-4241-84f9-edd76473b", "row_index": 558, "timestamp": "2018-04-17T22:14:44Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2d142b30-990f-4241-84f9-edd76473b", "eventTime": "2018-04-17T22:14:44Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f77187b-fdde-46c5-b4f7-1c30cb20d3d9", "record_id": "flaws_cloudtrail:0000559:f77187b-fdde-46c5-b4f7-1c30cb20d3d9", "row_index": 559, "timestamp": "2018-04-17T22:14:45Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ca-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1833, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f77187b-fdde-46c5-b4f7-1c30cb20d3d9", "eventTime": "2018-04-17T22:14:45Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ca-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: Y_IDSCMvYmKu4HBuj4BfDnshskHidXQZ4glCYEiBB7_c8ADi4FBJgt3IgxSLw6CCFz1RTJ3VVb-xk8dASJfBEFFMUk46WbPzpI_3U9zYyvkj-wGJ50v4-vfrdlLiPxTRGkt72pJ7fjqLcpQVMUR2qbmvTnT-VrBuCFA2uSdwsK6oEOrjCd11xXbtMm-amkiToQA0bvrI-559hDPhZSMfL1XEW-AAIRpTaoQ-oKtXi84YBwG3WgsDZ1IwpATy1LyMDOdWIwW4e0IknFskSYsHIBMt4JTl9gJoHh117clCvwO5oqAu6nGqqpM6n_k6-L6RB4xdI8wJZJPi6KCE61VvQZBvSLJL36TN_aqY1f5b9KUG16UhApTlXd9jMQCzmdxbMRDfl0kbngwd464HnFCK0VPUmSGFk5tOzcmzxkCHofxEW-wD0Efk8swvrIz1bH_ok7Df8rK4lJw2lgYgK5iqU09Kg4WiRpuujbpHtswFWKZYMXZqJS_hCGbyQ8AF0kiVay_oMN5z0qFaY4G5BcBFrW_5yis5nrbMWVUJUIy7X2EBcTnQoEmPrndRBCeuefxUndic8qPDY5UhyAWxjMieL83UxUn_qs7CoqMkXES_ovOr_6Y4kDeyr1RKb1mfK_DfCxsSq7BneuafpT5m52NKoRU-5jYYUUs_ajsWiA", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-bbcb674a", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c0c8014d-f896-49be-b6ed-2acb3fa7e2e3", "record_id": "flaws_cloudtrail:0000560:c0c8014d-f896-49be-b6ed-2acb3fa7e2e3", "row_index": 560, "timestamp": "2018-04-17T22:14:45Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c0c8014d-f896-49be-b6ed-2acb3fa7e2e3", "eventTime": "2018-04-17T22:14:45Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "03f9c05f-4714-480a-9cf1-949248dd58fcd", "record_id": "flaws_cloudtrail:0000561:03f9c05f-4714-480a-9cf1-949248dd58fcd", "row_index": 561, "timestamp": "2018-04-17T22:14:45Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1279, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "03f9c05f-4714-480a-9cf1-949248dd58fcd", "eventTime": "2018-04-17T22:14:45Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "015837f5f-03f9-46c5-aaa2-74b228bacd21", "record_id": "flaws_cloudtrail:0000562:015837f5f-03f9-46c5-aaa2-74b228bacd21", "row_index": 562, "timestamp": "2018-04-17T22:14:46Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1281, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "015837f5f-03f9-46c5-aaa2-74b228bacd21", "eventTime": "2018-04-17T22:14:46Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b5f6dc61-647c-41e8-add4-e3babfe9823d", "record_id": "flaws_cloudtrail:0000563:b5f6dc61-647c-41e8-add4-e3babfe9823d", "row_index": 563, "timestamp": "2018-04-17T22:14:46Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b5f6dc61-647c-41e8-add4-e3babfe9823d", "eventTime": "2018-04-17T22:14:46Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8566fab5-5d8b-4f3e-b730-8b011e5e1632", "record_id": "flaws_cloudtrail:0000564:8566fab5-5d8b-4f3e-b730-8b011e5e1632", "row_index": 564, "timestamp": "2018-04-17T22:14:46Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8566fab5-5d8b-4f3e-b730-8b011e5e1632", "eventTime": "2018-04-17T22:14:46Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "23ccc1e2-788c-49f7-aa42-b2a330b17ce9", "record_id": "flaws_cloudtrail:0000565:23ccc1e2-788c-49f7-aa42-b2a330b17ce9", "row_index": 565, "timestamp": "2018-04-17T22:14:46Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "23ccc1e2-788c-49f7-aa42-b2a330b17ce9", "eventTime": "2018-04-17T22:14:46Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7eefdd1b-cb42-4280-9b27-21d468a3b122", "record_id": "flaws_cloudtrail:0000566:7eefdd1b-cb42-4280-9b27-21d468a3b122", "row_index": 566, "timestamp": "2018-04-17T22:14:47Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7eefdd1b-cb42-4280-9b27-21d468a3b122", "eventTime": "2018-04-17T22:14:47Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "752165e18-9672-46ac-8633-ce29ff0aab46", "record_id": "flaws_cloudtrail:0000567:752165e18-9672-46ac-8633-ce29ff0aab46", "row_index": 567, "timestamp": "2018-04-17T22:14:47Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1838, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "752165e18-9672-46ac-8633-ce29ff0aab46", "eventTime": "2018-04-17T22:14:47Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-southeast-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: q-bPrTMkZvsyaoSkzPx-OJAeqprGj8eDZX8lDRDvvaozkqd1JQZmeTaIdUEFxMDFb3Iy1LjlmUa83cVtgoxqruGrTAEK0t8WpCovXiS9Ydm24j2fQoZeFZHxjiYohmB3jO8zkRPU72T7B8A-DrsZV7luLQKpHPLglneGkWJrWdFfHxoli-L7c_W3UeRJJbGGwwUIWoHF2xWanNG7tnnMSl0bccKXpGWgMo2rUZe6g5G1BwtdvR6UZIvBjaqH4BmYMA817LVTq4h63MwNsCGZwbWGJY6-giy9C8WodTpEGpq2hOLgM4R-RiboNscIbdvMzs5IE-C8-vCbyfkjFhvb6u5Hi8VXoxyynw_MGVmv625NuIJp5hwBzztASrCBi6eMXWaqQ30Ac9exkMC5-7IC60NLDi2waqdFKuEBbbH_ro9EBjGlzlphdZ4ZJVSm91Tvnqbc9luW7b3wxAn6icBYELjabJYedwHN-jGiZyrYSiFuS7dvkVvH_dPfeV9wAWS2OWe9BQwXmsRsuIP0Hwr0ZvJ5FgHh_y3ZnLabMYTHRdBECKkdcuymaPHayJlPk74npgY6rUtmFYVdeSr0NcmU8F-HjDFw6oEUID9OGZUxGUu8q4IC7n8vY-QVDzOOA1fiTQOsDKV70_vxF4V2Wgebf-CzDT5XToiZEYOdYGU", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-02d34bac", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "44d1fa8b-2324-4361-a612-f57231f674918", "record_id": "flaws_cloudtrail:0000568:44d1fa8b-2324-4361-a612-f57231f674918", "row_index": 568, "timestamp": "2018-04-17T22:14:47Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "44d1fa8b-2324-4361-a612-f57231f674918", "eventTime": "2018-04-17T22:14:47Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e7137fc9-f8e6-461a-b948-d70e0a1c548b", "record_id": "flaws_cloudtrail:0000569:e7137fc9-f8e6-461a-b948-d70e0a1c548b", "row_index": 569, "timestamp": "2018-04-17T22:14:47Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e7137fc9-f8e6-461a-b948-d70e0a1c548b", "eventTime": "2018-04-17T22:14:47Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ab929c64-702b-4817-886d-70a3c026d913", "record_id": "flaws_cloudtrail:0000570:ab929c64-702b-4817-886d-70a3c026d913", "row_index": 570, "timestamp": "2018-04-17T22:14:48Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1276, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ab929c64-702b-4817-886d-70a3c026d913", "eventTime": "2018-04-17T22:14:48Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6a17f48f-1f1a-4908-84e7-103291d73d", "record_id": "flaws_cloudtrail:0000571:6a17f48f-1f1a-4908-84e7-103291d73d", "row_index": 571, "timestamp": "2018-04-17T22:14:49Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6a17f48f-1f1a-4908-84e7-103291d73d", "eventTime": "2018-04-17T22:14:49Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "185b2f50-2035-49b1-8277-345f0308cc52", "record_id": "flaws_cloudtrail:0000572:185b2f50-2035-49b1-8277-345f0308cc52", "row_index": 572, "timestamp": "2018-04-17T22:14:49Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "185b2f50-2035-49b1-8277-345f0308cc52", "eventTime": "2018-04-17T22:14:49Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf9e9725-7922-4f19-97c3-8f06cfb040c5", "record_id": "flaws_cloudtrail:0000573:bf9e9725-7922-4f19-97c3-8f06cfb040c5", "row_index": 573, "timestamp": "2018-04-17T22:14:49Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1172, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf9e9725-7922-4f19-97c3-8f06cfb040c5", "eventTime": "2018-04-17T22:14:49Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aea9e367-28b8-4e3b-9521-461e64cbb399", "record_id": "flaws_cloudtrail:0000574:aea9e367-28b8-4e3b-9521-461e64cbb399", "row_index": 574, "timestamp": "2018-04-17T22:14:49Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1828, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aea9e367-28b8-4e3b-9521-461e64cbb399", "eventTime": "2018-04-17T22:14:49Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: HdWuGrh114oWOAhLEr5sh8EBAc_XLnYIpu2mbk-GqB5yZjRwSn8VyP9-W_0k_WJKIT7U1woW2z-sV5YtcMElPHXV-QyxBT7yMVY8AnqhxWho8w-TAKi4PYp_5w8NqcG1TWWd2VRIi4Eehm3IC9l7eZTjHaS871yoDoQTTzN3qkTcwYoxTgd1mIMCR9SNnOXADRVYrmz1Vvi3iufZcKomzuFRtpyUliI2-OkvnSXggzEqchxjoSTTXah4K4TWU2RFieSZ16ki6SNLiMR8J4C0bPXm-b6Cg8Xw6FtqCr3z5NcSDjoa5VEFF879EkbJNQnmJPiLbdDkTniJdhudxkofvzVm9UxwPXTvDdS5m2z2cGbhQqtGE2GRH-q1JrXqf9p9kbBOSYjjJJTJlR7t6WWNBXSGMCAnYMzNG00zI6VXLgfL-zYcOek_Jk3byRIrjG7i_XCxgbN4AvK5tjqqBo_gHObfpqVS2yDrJWLetcDsoh5vG08kt8SUWOrMRyb0OoNubPJevaz2_LHLJQyI0P9D4sqx1U95Rp9Sigt3xiUuJmHmiKOwlGcgRxJ446YCQrLwXn0oWnd8tjkTup_QU4JPOsk3KnlDCebrlV2HLfsQiQ_xDSQoJjhQndhm3f9FnEkYwmdP5W7-CvqRJeha2fSJj6gLwKgxpPB3S9Q", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-009dc204", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "56b1e599-3f23-4ef5-ab9d-9653c328be4f", "record_id": "flaws_cloudtrail:0000575:56b1e599-3f23-4ef5-ab9d-9653c328be4f", "row_index": 575, "timestamp": "2018-04-17T22:14:50Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "56b1e599-3f23-4ef5-ab9d-9653c328be4f", "eventTime": "2018-04-17T22:14:50Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9305f8af-1d55-4496-acf8-15752bf9", "record_id": "flaws_cloudtrail:0000576:9305f8af-1d55-4496-acf8-15752bf9", "row_index": 576, "timestamp": "2018-04-17T22:14:51Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9305f8af-1d55-4496-acf8-15752bf9", "eventTime": "2018-04-17T22:14:51Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "43adb1b7-d6b4-402d-833c-4e51611627f1", "record_id": "flaws_cloudtrail:0000577:43adb1b7-d6b4-402d-833c-4e51611627f1", "row_index": 577, "timestamp": "2018-04-17T22:14:51Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "43adb1b7-d6b4-402d-833c-4e51611627f1", "eventTime": "2018-04-17T22:14:51Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "30e17a5c-6d12-4460-86b3-3d113b7071f3", "record_id": "flaws_cloudtrail:0000578:30e17a5c-6d12-4460-86b3-3d113b7071f3", "row_index": 578, "timestamp": "2018-04-17T22:14:51Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 1827, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "30e17a5c-6d12-4460-86b3-3d113b7071f3", "eventTime": "2018-04-17T22:14:51Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "us-east-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: tK877xxYL2eqBuSRPtA3S9ZndA-fpK8A6q8w7WcqR2xZzbXW4Ok2djT2bpmsDhtjPjKDwYUSAeoBWIUeOkXkGgHJGfemqQFFnX4BdbxMLKrAngnsLDa_E_U7ue-P0f9lsEcN4W98g7u0GVXzksHvfObGiPdlNWm4xeDQ84PXKmm0JqdleKMePx2g1TiJZokUkL8PKu9NAKeF9VPEhK1b9AXWDSRjVxMGmiEiFuTDG-UmmuV0De4yeYias5OlnTsj60dpJaBY4HjUFGDCDzyP9m0h5pEKCTEd0CoZRlze5cncPPiHZCqy_CYb_7dfFASKPP8Sr-bQp_O7wAA2djoTMi9KmAF2PvCDfNaLP6xc15lW8WouMBVKCUPH1eS3Ov7AIP8MFeQxRcz9NeQvx2ReDAQHcoifYsd37GHHrstP6hUIqJfX8DzLO2gLqN38754b0xbH8K1v9R-R4uf_i6PAa3008tZK32GTv1aOwJ48-bBBu3z8X9yCRoOKywyhnHhqiudEB-nBWBtYV1JieuMq3D8JU0C6cecyVPNyra1hVPPnFaleVi-KFdMaivplvNxYnJWKEv-qpp7fDzjGz7fesz0LvDMvbYw_I9n98qPG7s-mGEqQE9FKprGBVJ6qBxxWEU4KidfaztDU20wHI0GEpLuTKHXj1xTeVA", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-71cdc376", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1465f332-f03a-46a5-ae2f-25f0bebc227d", "record_id": "flaws_cloudtrail:0000579:1465f332-f03a-46a5-ae2f-25f0bebc227d", "row_index": 579, "timestamp": "2018-04-17T22:14:52Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1465f332-f03a-46a5-ae2f-25f0bebc227d", "eventTime": "2018-04-17T22:14:52Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1c5729dc-ce00-4cbc-9ba3-449ce282b36a", "record_id": "flaws_cloudtrail:0000580:1c5729dc-ce00-4cbc-9ba3-449ce282b36a", "row_index": 580, "timestamp": "2018-04-17T22:14:52Z", "event_type": "CreateDefaultVpc", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1c5729dc-ce00-4cbc-9ba3-449ce282b36a", "eventTime": "2018-04-17T22:14:52Z", "eventName": "CreateDefaultVpc", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"CreateDefaultVpcRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a4d7678f-ac4b-4a34-9e78-9552c50526", "record_id": "flaws_cloudtrail:0000581:a4d7678f-ac4b-4a34-9e78-9552c50526", "row_index": 581, "timestamp": "2018-04-17T22:14:53Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1274, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a4d7678f-ac4b-4a34-9e78-9552c50526", "eventTime": "2018-04-17T22:14:53Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "05365d8f-8fce-4884-8470-2ff606b0f230", "record_id": "flaws_cloudtrail:0000582:05365d8f-8fce-4884-8470-2ff606b0f230", "row_index": 582, "timestamp": "2018-04-17T22:14:53Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "05365d8f-8fce-4884-8470-2ff606b0f230", "eventTime": "2018-04-17T22:14:53Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9d748a57-3f87-40da-82e1-a3630fb4d87f", "record_id": "flaws_cloudtrail:0000583:9d748a57-3f87-40da-82e1-a3630fb4d87f", "row_index": 583, "timestamp": "2018-04-17T22:14:54Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1281, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9d748a57-3f87-40da-82e1-a3630fb4d87f", "eventTime": "2018-04-17T22:14:54Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cfff7b03-d7e7-473b-8b56-dd7a8cedc0e1", "record_id": "flaws_cloudtrail:0000584:cfff7b03-d7e7-473b-8b56-dd7a8cedc0e1", "row_index": 584, "timestamp": "2018-04-17T22:14:54Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cfff7b03-d7e7-473b-8b56-dd7a8cedc0e1", "eventTime": "2018-04-17T22:14:54Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4aca1c08-2028-436e-bd9c-614e936b4842", "record_id": "flaws_cloudtrail:0000585:4aca1c08-2028-436e-bd9c-614e936b4842", "row_index": 585, "timestamp": "2018-04-17T22:14:54Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4aca1c08-2028-436e-bd9c-614e936b4842", "eventTime": "2018-04-17T22:14:54Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ad0f85fb-62ba-43f2-b4bc-b2f4db199791", "record_id": "flaws_cloudtrail:0000586:ad0f85fb-62ba-43f2-b4bc-b2f4db199791", "row_index": 586, "timestamp": "2018-04-17T22:14:55Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ad0f85fb-62ba-43f2-b4bc-b2f4db199791", "eventTime": "2018-04-17T22:14:55Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "34e26a5a-4910-434a-ad33-16862f72", "record_id": "flaws_cloudtrail:0000587:34e26a5a-4910-434a-ad33-16862f72", "row_index": 587, "timestamp": "2018-04-17T22:14:55Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1276, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "34e26a5a-4910-434a-ad33-16862f72", "eventTime": "2018-04-17T22:14:55Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dea441307-75ab-41a8-b8ec-6258272ff8d4", "record_id": "flaws_cloudtrail:0000588:dea441307-75ab-41a8-b8ec-6258272ff8d4", "row_index": 588, "timestamp": "2018-04-17T22:14:55Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dea441307-75ab-41a8-b8ec-6258272ff8d4", "eventTime": "2018-04-17T22:14:55Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d91585be-e9bb-45ae-8de5-82da77c95008", "record_id": "flaws_cloudtrail:0000589:d91585be-e9bb-45ae-8de5-82da77c95008", "row_index": 589, "timestamp": "2018-04-17T22:14:55Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d91585be-e9bb-45ae-8de5-82da77c95008", "eventTime": "2018-04-17T22:14:55Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d0daf02e-4ec0-4666-9617-10d150847a9", "record_id": "flaws_cloudtrail:0000590:d0daf02e-4ec0-4666-9617-10d150847a9", "row_index": 590, "timestamp": "2018-04-17T22:14:56Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d0daf02e-4ec0-4666-9617-10d150847a9", "eventTime": "2018-04-17T22:14:56Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cb7089f6-840e-4fc8-b0be-63aaae168209", "record_id": "flaws_cloudtrail:0000591:cb7089f6-840e-4fc8-b0be-63aaae168209", "row_index": 591, "timestamp": "2018-04-17T22:14:56Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cb7089f6-840e-4fc8-b0be-63aaae168209", "eventTime": "2018-04-17T22:14:56Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5faf51f1-a7ed-47ce-a52e-6462e108e9d7", "record_id": "flaws_cloudtrail:0000592:5faf51f1-a7ed-47ce-a52e-6462e108e9d7", "row_index": 592, "timestamp": "2018-04-17T22:14:56Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5faf51f1-a7ed-47ce-a52e-6462e108e9d7", "eventTime": "2018-04-17T22:14:56Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "23da3a3f-9d82-4b76-860c-393be9524e34", "record_id": "flaws_cloudtrail:0000593:23da3a3f-9d82-4b76-860c-393be9524e34", "row_index": 593, "timestamp": "2018-04-17T22:14:57Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1174, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "23da3a3f-9d82-4b76-860c-393be9524e34", "eventTime": "2018-04-17T22:14:57Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9cdd2525-c7a9-44ff-a54b-072a62d5b064", "record_id": "flaws_cloudtrail:0000594:9cdd2525-c7a9-44ff-a54b-072a62d5b064", "row_index": 594, "timestamp": "2018-04-17T22:14:57Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9cdd2525-c7a9-44ff-a54b-072a62d5b064", "eventTime": "2018-04-17T22:14:57Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d317762b-87a3-4450-87d7-f5c50e2df297", "record_id": "flaws_cloudtrail:0000595:d317762b-87a3-4450-87d7-f5c50e2df297", "row_index": 595, "timestamp": "2018-04-17T22:14:58Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1172, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d317762b-87a3-4450-87d7-f5c50e2df297", "eventTime": "2018-04-17T22:14:58Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "72e360c6-82d1-408d-8792-134fda74ec3a", "record_id": "flaws_cloudtrail:0000596:72e360c6-82d1-408d-8792-134fda74ec3a", "row_index": 596, "timestamp": "2018-04-17T22:14:58Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-central-1"}, "resource_arns": [], "raw_record_size_bytes": 1832, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "72e360c6-82d1-408d-8792-134fda74ec3a", "eventTime": "2018-04-17T22:14:58Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-central-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 15NkLufgXFMHV47Z-Zp_vEfid5umw95217UsKt0ntVuizigacgGj24FZgIUXBP6kR9t2_DqtBhqg5K5s9jnvNW50M3g7YqQAyDnn9vDs6_oLVmWnZKi3YYjghIDPPzk-tKRtmKmS9Rs4tgWvwVWJavgv5Wl6LUYu7dQxgQfy5uSwqGq-Fh-QpvQ_R3COhua9stzpzqUTcsFOV17n_q6r14aM6cydHa6ME3S2em6negRgzFFXbeW0ov9U8e2DGgi5J2UaEHzM-ehIsLO1AA-MzUsmdF9Ifz4vX2DggvheqSvPsxQE97WIBxMW54lv4JdjlxkUxA6q85Z574AHsUpM_3LzCzUNvjDUj35lo9J7v9fZuXDZSlLk44zfx7kJYjWaRq-Ogq7fdbGMDWmGueegJBxhStkfLzu4GGi6X-GLssPBRnDn1m6Snip4wuBH6hV3YK_uaSbXCm7OLTMopx9DHtE3xhswDypBr_6ieFB7A6Sn4d2wCk9YkSWk4e0dHy5mz6tvxAlLXMW1HcB99HADre5NelYvi0jE_xlUQ_WucQs6udk-tEI1qmtWRpyApxw326nFMPNJ9R4un4kgONXaowuQlekkcovT_EdM1UrqRJoMFMDw-AThhDveJBnZQfbr_4Ib608taE4v4NPCrGcROSytj78YjU7SwrLQ", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-d10c94e9", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "07984-2972-4bd9-8d40-f212bf8844ef", "record_id": "flaws_cloudtrail:0000597:07984-2972-4bd9-8d40-f212bf8844ef", "row_index": 597, "timestamp": "2018-04-17T22:14:58Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1273, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "07984-2972-4bd9-8d40-f212bf8844ef", "eventTime": "2018-04-17T22:14:58Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e6474e11-66bd-47bf-a142-c9f343163", "record_id": "flaws_cloudtrail:0000598:e6474e11-66bd-47bf-a142-c9f343163", "row_index": 598, "timestamp": "2018-04-17T22:14:58Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1275, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e6474e11-66bd-47bf-a142-c9f343163", "eventTime": "2018-04-17T22:14:58Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "27903a19-b86a-4c2a-a9b4-330b05d18b74", "record_id": "flaws_cloudtrail:0000599:27903a19-b86a-4c2a-a9b4-330b05d18b74", "row_index": 599, "timestamp": "2018-04-17T22:14:58Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "27903a19-b86a-4c2a-a9b4-330b05d18b74", "eventTime": "2018-04-17T22:14:58Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "77510aa-4d00-4968-aa83-f87f109a19ef", "record_id": "flaws_cloudtrail:0000600:77510aa-4d00-4968-aa83-f87f109a19ef", "row_index": 600, "timestamp": "2018-04-17T22:14:59Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1276, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "77510aa-4d00-4968-aa83-f87f109a19ef", "eventTime": "2018-04-17T22:14:59Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8d24d8a0-00b7-4005-983e-6a8be1a60492", "record_id": "flaws_cloudtrail:0000601:8d24d8a0-00b7-4005-983e-6a8be1a60492", "row_index": 601, "timestamp": "2018-04-17T22:14:59Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8d24d8a0-00b7-4005-983e-6a8be1a60492", "eventTime": "2018-04-17T22:14:59Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "469442f-83ef-4df9-8869-855c8183d43c", "record_id": "flaws_cloudtrail:0000602:469442f-83ef-4df9-8869-855c8183d43c", "row_index": 602, "timestamp": "2018-04-17T22:15:00Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "469442f-83ef-4df9-8869-855c8183d43c", "eventTime": "2018-04-17T22:15:00Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4f801485-0390-403c-b415-b6526c3f352e", "record_id": "flaws_cloudtrail:0000603:4f801485-0390-403c-b415-b6526c3f352e", "row_index": 603, "timestamp": "2018-04-17T22:15:01Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "ap-south-1"}, "resource_arns": [], "raw_record_size_bytes": 1830, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4f801485-0390-403c-b415-b6526c3f352e", "eventTime": "2018-04-17T22:15:01Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "ap-south-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: gmoypTwaIlWjzkBEz05TPL-YEkdiUYsqPssr-s3v5l_OM7BmcB-tYJFC0o4mfxZ18TLuLymsDk3HJFxpK-FOAKect8UjczOx6Sibrmxfvm1xcueueBOORTgi4MUfSaXHMHzUDylVERrT4ek73LNIVW4VTsDe9ULb9v9ecECVU2yLVXYaI2sqNwFPlIWbxkJvwQB5GyI-xTs351PcfcchrK1Gjram8G1e8aRtWZ7UlvmYud2x65o0EaV9G9gx6qkIJY0X5J20_jysp5J9bqot09Kb-iFAUMbljZm_H4qZYZwlemR0f_zup2QyNdXO54lcOUKuBQJJkUmrNlA1HA45zQ7KTX0E_CJn2XDplT-Btyw0Vh2dJ8uzG9w_BmDhySED2ufPpiHqc5QJGNGDKj8F8fCkhZUUB6erE1tCNepCUE5p8IQ7HSu2FUG_4Al0YbIwxpQYkDPP3L4E1Lt12fcWN82NjnloXv1nCS8F-__HIM47lFFMyhbskKhvC-DsR9vAkR17geA39y3PA7gOwTUBiXK4qopU872GD9SkJ-KcJC3XVQ0ojXjmY3I4oa5XRt4WvZAnzs6Gdid2cbtkxNGYAnIpwyml7Kjlt3yEWcsiHFk_qVoa9rn4uL4cUOT4PlmkU-K_4m1JWz-3y5BLYVOf7A_yDdzkPMEp-B88", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-8c971d21", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f6222a59-8578-44c1-91f1-bb3cce18ac90", "record_id": "flaws_cloudtrail:0000604:f6222a59-8578-44c1-91f1-bb3cce18ac90", "row_index": 604, "timestamp": "2018-04-17T22:15:01Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1171, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f6222a59-8578-44c1-91f1-bb3cce18ac90", "eventTime": "2018-04-17T22:15:01Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f1a8607b-0075-4f91-afeb-64c6112795a4", "record_id": "flaws_cloudtrail:0000605:f1a8607b-0075-4f91-afeb-64c6112795a4", "row_index": 605, "timestamp": "2018-04-17T22:15:01Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1277, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f1a8607b-0075-4f91-afeb-64c6112795a4", "eventTime": "2018-04-17T22:15:01Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "m5.24xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "54abb87c-ff54-4b7b-a03f-57e004566228", "record_id": "flaws_cloudtrail:0000606:54abb87c-ff54-4b7b-a03f-57e004566228", "row_index": 606, "timestamp": "2018-04-17T22:15:02Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1278, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "54abb87c-ff54-4b7b-a03f-57e004566228", "eventTime": "2018-04-17T22:15:02Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.InstanceLimitExceeded", "errorMessage": "You have requested more instances (1) than your current instance limit of 0 allows for the specified instance type. Please visit http://aws.amazon.com/contact-us/ec2-request to request an adjustment to this limit.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dc20776-1f88-498e-9b3b-00bc4225313c", "record_id": "flaws_cloudtrail:0000607:dc20776-1f88-498e-9b3b-00bc4225313c", "row_index": 607, "timestamp": "2018-04-17T22:15:02Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1824, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dc20776-1f88-498e-9b3b-00bc4225313c", "eventTime": "2018-04-17T22:15:02Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 2Dw0HHooMKOuCBoCeEb5BfoQlAVjDNDYg4d4_RKtr3GXg1hUINZogc6FzSMb9Vjq4thZfm1yOZLpM8hpI-qZE-JvL_f3wp1tNeCbd9hPBJnty4UqmBbCGZRTezJLlR-vkX5MXh6incA7QBPXjGtazLB2iGbXgMQUIDHNkPmXz_PWDSMU0Ra0H2Zp196dVn-bHxrqEX4kGpa2n7aphseLAlmABkpvDhDi43ysZHqqGFOq-0qwgrUzjo0uw9O7kM7A5hOBia3BR_hw7t2O9MQrYrKqKGa9u2sTUaoUCrkHEp6r7XgkxdgPh8xg804R9yyY6VGItJMLvotuOERzMdZWz3Sw7sr7sqMXteiLFghFshH3rL2IXCZ-NMNKG0q0vPcsDvV4pxUOibED5Fg2-qiogcGO_zZmhmKVYyiaiqPH926ClmrfBvbevljC1VifZFP9Cy17kj-xNLFjxL0ZkYdQzZvdd-5GMnjcsgeIrlUN4XJ6ERa_DrIhwBpjTejQ7x5kEBTNuycHnxO8SaDawQH0a7F2O6-h-sXmcuNu-aKPfEHZ29KcpYVs_qXc8WhdjDzl_3ABYL33tXlTYtwJmRebnmCbA9DVuAfG4z74HILllkbI19UJvA4eiUIqIf4v7nna5uv3m3rurInJgaxsgB7XrV7tD5y6sbuGMw", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-63f71193", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "924c8f6a-bfb8-4158-a59b-6bd48cd4c522", "record_id": "flaws_cloudtrail:0000608:924c8f6a-bfb8-4158-a59b-6bd48cd4c522", "row_index": 608, "timestamp": "2018-04-17T22:15:02Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-3"}, "resource_arns": [], "raw_record_size_bytes": 1171, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "924c8f6a-bfb8-4158-a59b-6bd48cd4c522", "eventTime": "2018-04-17T22:15:02Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-3", "errorCode": "Client.Unsupported", "errorMessage": "The requested configuration is currently not supported. Please check the documentation for supported configurations.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-3a3a9be3", "minCount": 1, "maxCount": 10}]}, "instanceType": "x1e.32xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ed033e0f-251a-4f07-95b7-e1d542c289933", "record_id": "flaws_cloudtrail:0000609:ed033e0f-251a-4f07-95b7-e1d542c289933", "row_index": 609, "timestamp": "2018-04-17T22:15:03Z", "event_type": "RunInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "155.63.17.217", "user_agent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1829, "raw_record_depth": 7, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ed033e0f-251a-4f07-95b7-e1d542c289933", "eventTime": "2018-04-17T22:15:03Z", "eventName": "RunInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "155.63.17.217", "userAgent": "Boto3/1.7.4 Python/2.7.12 Linux/4.4.0-119-generic Botocore/1.10.4", "awsRegion": "eu-west-1", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: E-Jc6N1Ds5QVFXTXkRBFojOgBuhWbKAPuMW7D1aOFL-0VMK3RNEz4LEDjQ00fLAJUwzsheCcgfYVITNRKMVlBY5yE3_Ekt8jmAo4mk_3Vtw6C8_RUT5_kuHG8sEe73Lj4vjrp8GfAZm0sqgO8EGqbHvo0ByFKvWqlgO_T6RGYwAUO1xdAywDrHUiAOHImxtSoB317m9ej2Jt1_5V9cSuWOXmDMbiXipyM08-ro-_Xkswt9HOqyJNy_jCIwhvW_Mmpm_Ol5aQKdkeYhC_N31yqXnk_87Qp22LL4D33zeiDN3daUfml7OXZZqgEKGXqNu6fVuGgcvBkBWziRH-bIJ2XuwGAQrgVRp_hXoNmWAzPBRPSMjJ5_ZIzBkq5ADkSj4YAg0rpNm2Uv7w09Vb9p2JpO8tKq13MuDVf1DsjFrhmgsPfUabsZuz79hdYtFmjQxE84xos8VObMnLcFcHZnYPChop1Ou3PwdjEsn3-k9hVaSDnfdpAN4Yn8esIeqJ-aWP3Wb-HpREnTQ8KtLGb7WZa2NULFT38TyEwILimLv3VpRBlLUPIKV_rBsWg3q5fIWyUj_tKKUNHRiPwy55LE_L9HCv5MMB2OCe2fQv1FhfTPaaUblOEszo_9nfn5E14KyC4UnyQmekO-zpRxfzsgOh0GfE2wXJ2SxeWTw", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"imageId": "ami-2b129c1b", "minCount": 1, "maxCount": 10}]}, "instanceType": "c5.18xlarge", "monitoring": {"enabled": false}, "disableApiTermination": true, "tagSpecificationSet": {"items": [{"resourceType": "instance", "tags": [{"__truncated_type": "dict"}]}]}}, "resources": []}}