Task: attack_reconstruction (flaws_cloudtrail)
Prompt: One principal appears to gain a foothold and then conduct a broad AWS inventory sweep spanning IAM, EC2/VPC, S3, Lambda, and RDS. Identify the responsible principal, the MITRE ATT&CK technique that best describes the behavior, the supporting CloudTrail record_ids grouped by each phase of the chain, and the impacted AWS assets. Return a JSON object matching the AttackReconstructionAnswer schema. Use principal.arn for primary_actor, the MITRE ATT&CK ID (e.g. T1530) for technique, and group the supporting CloudTrail record_ids by attack phase. List the AWS asset identifiers (bucket names, role/user names, trail names, ARNs) the attack acted on as impacted_assets.
Answer schema: attack_reconstruction_answer

CloudTrail records:
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2f5ffe3f-c448-4faf-8713-ae982472", "record_id": "flaws_cloudtrail:0000000:2f5ffe3f-c448-4faf-8713-ae982472", "row_index": 0, "timestamp": "2017-02-27T02:11:01Z", "event_type": "GetBucketLocation", "event_source": "s3.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "[S3Console/0.4]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2f5ffe3f-c448-4faf-8713-ae982472", "eventTime": "2017-02-27T02:11:01Z", "eventName": "GetBucketLocation", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "[S3Console/0.4]", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"bucketName": "level6-588e81908c84e62a6dd8202d535469dd.flaws.cloud", "location": [""]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f5d322283-696b-4ec3-9b0e-b1bab2b9da80", "record_id": "flaws_cloudtrail:0000001:f5d322283-696b-4ec3-9b0e-b1bab2b9da80", "row_index": 1, "timestamp": "2017-02-27T02:11:01Z", "event_type": "GetBucketVersioning", "event_source": "s3.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "[S3Console/0.4]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f5d322283-696b-4ec3-9b0e-b1bab2b9da80", "eventTime": "2017-02-27T02:11:01Z", "eventName": "GetBucketVersioning", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "[S3Console/0.4]", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"bucketName": "level6-588e81908c84e62a6dd8202d535469dd.flaws.cloud", "versioning": [""]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8beb4458-1f4a-4b3c-8422-9ef62417ebd", "record_id": "flaws_cloudtrail:0000002:8beb4458-1f4a-4b3c-8422-9ef62417ebd", "row_index": 2, "timestamp": "2017-02-27T02:11:44Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAZIX9Y7HJYESX8N5G", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "8.123.160.67", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1027, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8beb4458-1f4a-4b3c-8422-9ef62417ebd", "eventTime": "2017-02-27T02:11:44Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "8.123.160.67", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAZIX9Y7HJYESX8N5G", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-02-27T00:25:39Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logGroupName": "/aws/lambda/Level6", "logStreamName": "2017/02/27/[$LATEST]94f5fab02272274e379ff74539963048"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4207f9aa-1765-41e7-a8f0-2219cd75cd06", "record_id": "flaws_cloudtrail:0000003:4207f9aa-1765-41e7-a8f0-2219cd75cd06", "row_index": 3, "timestamp": "2017-02-27T02:16:24Z", "event_type": "GetBucketVersioning", "event_source": "s3.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "[S3Console/0.4]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4207f9aa-1765-41e7-a8f0-2219cd75cd06", "eventTime": "2017-02-27T02:16:24Z", "eventName": "GetBucketVersioning", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "[S3Console/0.4]", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"bucketName": "level6-588e81908c84e62a6dd8202d535469dd.flaws.cloud", "versioning": [""]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fde9140d-2247-47fd-8a59-5094bfc6de21", "record_id": "flaws_cloudtrail:0000004:fde9140d-2247-47fd-8a59-5094bfc6de21", "row_index": 4, "timestamp": "2017-02-27T02:16:32Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "AWS Internal", "user_agent": "[AWSCloudTrail, aws-internal/3]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 634, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fde9140d-2247-47fd-8a59-5094bfc6de21", "eventTime": "2017-02-27T02:16:32Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "AWS Internal", "userAgent": "[AWSCloudTrail, aws-internal/3]", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4a3d9e58-7b1f-4a49-aa8e-ec06f4da0461", "record_id": "flaws_cloudtrail:0000005:4a3d9e58-7b1f-4a49-aa8e-ec06f4da0461", "row_index": 5, "timestamp": "2017-02-27T02:16:32Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAPRJFFJ12TBWPTY4U", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4a3d9e58-7b1f-4a49-aa8e-ec06f4da0461", "eventTime": "2017-02-27T02:16:32Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAPRJFFJ12TBWPTY4U", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"trailNameList": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1ea158fe-91dc-4779-bcf0-c4c99a5c2d58", "record_id": "flaws_cloudtrail:0000006:1ea158fe-91dc-4779-bcf0-c4c99a5c2d58", "row_index": 6, "timestamp": "2017-02-27T02:16:33Z", "event_type": "DescribeConfigurationRecorderStatus", "event_source": "config.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAPRJFFJ12TBWPTY4U", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "AWSCloudTrail, aws-internal/3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 720, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1ea158fe-91dc-4779-bcf0-c4c99a5c2d58", "eventTime": "2017-02-27T02:16:33Z", "eventName": "DescribeConfigurationRecorderStatus", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "AWSCloudTrail, aws-internal/3", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAPRJFFJ12TBWPTY4U", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3342c56b-47a0-437c-9301-32642e6fff", "record_id": "flaws_cloudtrail:0000007:3342c56b-47a0-437c-9301-32642e6fff", "row_index": 7, "timestamp": "2017-02-27T02:16:33Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAPRJFFJ12TBWPTY4U", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "AWSCloudTrail, aws-internal/3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 713, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3342c56b-47a0-437c-9301-32642e6fff", "eventTime": "2017-02-27T02:16:33Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "AWSCloudTrail, aws-internal/3", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAPRJFFJ12TBWPTY4U", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b8de7eb4-2b47-4f50-b45e-d7ccfba2c6f0", "record_id": "flaws_cloudtrail:0000008:b8de7eb4-2b47-4f50-b45e-d7ccfba2c6f0", "row_index": 8, "timestamp": "2017-02-27T02:16:33Z", "event_type": "LookupEvents", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAPRJFFJ12TBWPTY4U", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b8de7eb4-2b47-4f50-b45e-d7ccfba2c6f0", "eventTime": "2017-02-27T02:16:33Z", "eventName": "LookupEvents", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAPRJFFJ12TBWPTY4U", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"maxResults": 50}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "84313c4-7a88-48e4-9850-566247647673", "record_id": "flaws_cloudtrail:0000009:84313c4-7a88-48e4-9850-566247647673", "row_index": 9, "timestamp": "2017-02-27T02:43:52Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "[S3Console/0.4]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 620, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "84313c4-7a88-48e4-9850-566247647673", "eventTime": "2017-02-27T02:43:52Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "[S3Console/0.4]", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2c21daa2-9b51-47b9-9659-5e079c2552b6", "record_id": "flaws_cloudtrail:0000010:2c21daa2-9b51-47b9-9659-5e079c2552b6", "row_index": 10, "timestamp": "2017-02-27T02:43:55Z", "event_type": "GetBucketLocation", "event_source": "s3.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "[S3Console/0.4]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 667, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2c21daa2-9b51-47b9-9659-5e079c2552b6", "eventTime": "2017-02-27T02:43:55Z", "eventName": "GetBucketLocation", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "[S3Console/0.4]", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"bucketName": "flaws.cloud", "location": [""]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "da25dd0e-cd8b-46e6-a192-3d6971a091db", "record_id": "flaws_cloudtrail:0000011:da25dd0e-cd8b-46e6-a192-3d6971a091db", "row_index": 11, "timestamp": "2017-02-27T02:43:55Z", "event_type": "GetBucketLocation", "event_source": "s3.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "[S3Console/0.4]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 667, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "da25dd0e-cd8b-46e6-a192-3d6971a091db", "eventTime": "2017-02-27T02:43:55Z", "eventName": "GetBucketLocation", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "[S3Console/0.4]", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"bucketName": "flaws.cloud", "location": [""]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4dfa8c19-d196-4e47-ae72-14a77c6fdbc4", "record_id": "flaws_cloudtrail:0000012:4dfa8c19-d196-4e47-ae72-14a77c6fdbc4", "row_index": 12, "timestamp": "2017-02-27T02:43:55Z", "event_type": "GetBucketVersioning", "event_source": "s3.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "[S3Console/0.4]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 669, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4dfa8c19-d196-4e47-ae72-14a77c6fdbc4", "eventTime": "2017-02-27T02:43:55Z", "eventName": "GetBucketVersioning", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "[S3Console/0.4]", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"bucketName": "flaws.cloud", "versioning": [""]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e4f1e4c9-9c3f-4df2-961e-f5be08c4968a", "record_id": "flaws_cloudtrail:0000013:e4f1e4c9-9c3f-4df2-961e-f5be08c4968a", "row_index": 13, "timestamp": "2017-02-27T02:53:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1478, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e4f1e4c9-9c3f-4df2-961e-f5be08c4968a", "eventTime": "2017-02-27T02:53:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAZXIKQJM9RG1ZLNY9", "expiration": "Feb 27, 2017 9:24:35 AM", "sessionToken": "FQoDYXdzEDwaDNOjDySNwOx4glk3RCK3AwdbsDkwSgfYiRUGvXSuvKOJz5jzck+7DfO6AX3FMDJ8atu+COwDcbbNl6CikwaW+/AV1AIn5++mBq7HRG7MDUcptL2CnN2E/xZQYslKf7PjTPMKh5SMDMnz0A0Uv+v0yVS+AFLNLtMFdR73+SCw9Y//1mz+SBLPBZlIli/BHSDg51LLwZ7UJQ1Rr5sYhMoXJPiUOPfHMmUcVsRSCm4F4WpmeO7fN8uc4iXDUsjkKAGpPfPdnDpDkQUR2gRHTCmKjCBHGTtjqCSkowKnaiulQ43OupsSyb8KdYROlJU9e4S4xQwbBWp+wTcqwzwulT0b50HWk+idVMNg9gcJIMwuASgAIu9trVyo+eCFTCF0CCoLW6HjurzpVwcrEHF6ou0LXVue9a+J+l0PXj1kdEFHsfyEnRoWIMPrm2rJpE1OFtQsV1gICkEi9p6V9gR+2snbMyMdq56/mBAwoYD87UEA3Xucc7U+FxJu1/Su4KHWp03N0C8k789DSrkgFD3QMIZq3V4gODURr9nHWE9QVxw2K01VloRXaoG96WPkdA7RTz43xCwJSY8MlSrVRuO8xrUTIi4wA/2eZvoolanOxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "99eb9695-01f4-4f3e-8ab9-0a03eb6d0f33", "record_id": "flaws_cloudtrail:0000014:99eb9695-01f4-4f3e-8ab9-0a03eb6d0f33", "row_index": 14, "timestamp": "2017-02-27T03:01:14Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1479, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "99eb9695-01f4-4f3e-8ab9-0a03eb6d0f33", "eventTime": "2017-02-27T03:01:14Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIASE4KO1BUHT90L1L5", "expiration": "Feb 27, 2017 9:13:59 AM", "sessionToken": "FQoDYXdzEDwaDBYPaequ5QQ0BdNK7iK3A+okDRWDH/RCHMsxNo0NvsmgXiWWCeTeRPoi+O77hhrZV9F9ZPSiv0Ger9/s2E61N6ILxU6C20g78P/d2iLaU0B5T/wk3nzOIKfHQBkYkD2VgJwWMoTIiMysROvHYoaT2vC/+lm37htaom0fa8DEsnE6exzsNKTaSoEgbSrQi1YQ0aV2/KBb0SqfefgA2w0wzJZ3P8qzf89K/B65EledTakMr3dptiULEI9d72SS027965Ev/mxGnL5fFmCAG+lsMv7P0NjyxDk89NQeSt5PbJEI49acW0u0yaZegEMBQ0E2Fiy8z4skHRniwD0FP0mTuQUsE2Q4+tY4mPA+gs/81peS6rppBn94EYSxyl18K1WroM803BpGAT18bJeQZjp8sR+Ds2MVaaEfQTLYiXRmMz03ldCjdl1DoMgp6Oslewxi3B5zD65rGueRduJoMxNFph9XNo09si2nQ08GBpqZ8zm37v1XHz5HGVSgKyhc6VO6tWgPqar7XCNNIxPtESc78zrqd8Wor0Q2mjVZbdpwlV1hjLF+EqAH5nfRrfPV3dFuUKNz4lXNzSoOgj07T8EZzmW+0I3dJ710o+qzOxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2169d23b-6e61-4321-96dd-0d32d57e8f73", "record_id": "flaws_cloudtrail:0000015:2169d23b-6e61-4321-96dd-0d32d57e8f73", "row_index": 15, "timestamp": "2017-02-27T03:38:28Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "AWS Internal", "user_agent": "[AWSCloudTrail, aws-internal/3]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 632, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2169d23b-6e61-4321-96dd-0d32d57e8f73", "eventTime": "2017-02-27T03:38:28Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "AWS Internal", "userAgent": "[AWSCloudTrail, aws-internal/3]", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2e1a75b8-7e17-4eea-9612-25c21fcc877b", "record_id": "flaws_cloudtrail:0000016:2e1a75b8-7e17-4eea-9612-25c21fcc877b", "row_index": 16, "timestamp": "2017-02-27T03:38:28Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAPRJFFJ12TBWPTY4U", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2e1a75b8-7e17-4eea-9612-25c21fcc877b", "eventTime": "2017-02-27T03:38:28Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAPRJFFJ12TBWPTY4U", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"trailNameList": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ef377a63-6c4f-4499-867e-68fa9263d393", "record_id": "flaws_cloudtrail:0000017:ef377a63-6c4f-4499-867e-68fa9263d393", "row_index": 17, "timestamp": "2017-02-27T03:38:29Z", "event_type": "LookupEvents", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAPRJFFJ12TBWPTY4U", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ef377a63-6c4f-4499-867e-68fa9263d393", "eventTime": "2017-02-27T03:38:29Z", "eventName": "LookupEvents", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAPRJFFJ12TBWPTY4U", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"maxResults": 50}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7832b614-00c5-482d-bfa1-a6d0ef632853", "record_id": "flaws_cloudtrail:0000018:7832b614-00c5-482d-bfa1-a6d0ef632853", "row_index": 18, "timestamp": "2017-02-27T03:38:30Z", "event_type": "DescribeConfigurationRecorderStatus", "event_source": "config.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAPRJFFJ12TBWPTY4U", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "AWSCloudTrail, aws-internal/3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 720, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7832b614-00c5-482d-bfa1-a6d0ef632853", "eventTime": "2017-02-27T03:38:30Z", "eventName": "DescribeConfigurationRecorderStatus", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "AWSCloudTrail, aws-internal/3", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAPRJFFJ12TBWPTY4U", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3717bfb6-9839-487c-aacd-2b60840bb1c6", "record_id": "flaws_cloudtrail:0000019:3717bfb6-9839-487c-aacd-2b60840bb1c6", "row_index": 19, "timestamp": "2017-02-27T03:38:30Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAPRJFFJ12TBWPTY4U", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "AWSCloudTrail, aws-internal/3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 715, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3717bfb6-9839-487c-aacd-2b60840bb1c6", "eventTime": "2017-02-27T03:38:30Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "AWSCloudTrail, aws-internal/3", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAPRJFFJ12TBWPTY4U", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a08e9ae6-4587-4a90-ad14-aa7aa5c512309", "record_id": "flaws_cloudtrail:0000020:a08e9ae6-4587-4a90-ad14-aa7aa5c512309", "row_index": 20, "timestamp": "2017-02-27T04:01:45Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1480, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a08e9ae6-4587-4a90-ad14-aa7aa5c512309", "eventTime": "2017-02-27T04:01:45Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA93S599H7LEJOD7P6", "expiration": "Feb 27, 2017 10:35:15 AM", "sessionToken": "FQoDYXdzED0aDEPoBLUJVTadFiaROCK3A3kIYJvFTOD7dDx8DsJw7VXFB1OxDnD0r1R42R8Dw44GpE3Lk65IGESemTxfzz0ir+aMJs2pPcFhJMMgjp5jNBeSzzVsrZiXV9uDXbDF94xOVqPuNP6A1JmnBWPhlGfOh9P5yZB+OD9avs6tKYazrzAOtaMBJHHLHXU+ZmI8/I51MyJPh4BKrR1Mq7Fc4kkXQYHXtWYrWhRYXAunLQJ/rdynQvlYMy971HOcxlq4PggnLQyRQ1CPuUSg01PQUI3GF672n9rqS907B3PxmYfngLNffaKQoiN3L/r9TQjFqcsLqoqsH2bXtew+d31qmIXAHHjB25WNWLgi0jvMLznXwbbQYx5mm7XC7WoFyYLiTPcKUrLQb/E9zs/kzfewRchgJqeCZ2k7foBx+I3n3+vgf84HDtUa5/QCG06DVO9jSGJUYGfO+t/iXz/oornMN3e3Pjc+iErkSa6UQAn+DHiVHbsBTz4AH6L/zsQs0wvDloqNnKg4mqY64xzRIjOTI+pdBeQMZdiikatnhLRIyTfMDqVIVKvlB2sAhnNflZicIyrxIlY0894RTlnRrNaEFr4gUHeIszBBQb4oqcnOxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7acc4b55-6841-40c2-b9d6-6ff3f84e2a08", "record_id": "flaws_cloudtrail:0000021:7acc4b55-6841-40c2-b9d6-6ff3f84e2a08", "row_index": 21, "timestamp": "2017-02-27T04:17:15Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAPRJFFJ12TBWPTY4U", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7acc4b55-6841-40c2-b9d6-6ff3f84e2a08", "eventTime": "2017-02-27T04:17:15Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAPRJFFJ12TBWPTY4U", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"trailNameList": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2b78a2f6-5006-47ec-b59b-ec9ba41774b1", "record_id": "flaws_cloudtrail:0000022:2b78a2f6-5006-47ec-b59b-ec9ba41774b1", "row_index": 22, "timestamp": "2017-02-27T04:17:15Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "AWS Internal", "user_agent": "[AWSCloudTrail, aws-internal/3]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 631, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2b78a2f6-5006-47ec-b59b-ec9ba41774b1", "eventTime": "2017-02-27T04:17:15Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "AWS Internal", "userAgent": "[AWSCloudTrail, aws-internal/3]", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fbe05206-0c0f-4723-91e9-a11c4e12444", "record_id": "flaws_cloudtrail:0000023:fbe05206-0c0f-4723-91e9-a11c4e12444", "row_index": 23, "timestamp": "2017-02-27T04:17:16Z", "event_type": "LookupEvents", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAPRJFFJ12TBWPTY4U", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fbe05206-0c0f-4723-91e9-a11c4e12444", "eventTime": "2017-02-27T04:17:16Z", "eventName": "LookupEvents", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAPRJFFJ12TBWPTY4U", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"maxResults": 50}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "edf8d1b9-1dbb-49d1-8f95-58c31ed7d4df", "record_id": "flaws_cloudtrail:0000024:edf8d1b9-1dbb-49d1-8f95-58c31ed7d4df", "row_index": 24, "timestamp": "2017-02-27T04:17:17Z", "event_type": "DescribeConfigurationRecorderStatus", "event_source": "config.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAPRJFFJ12TBWPTY4U", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "AWSCloudTrail, aws-internal/3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 720, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "edf8d1b9-1dbb-49d1-8f95-58c31ed7d4df", "eventTime": "2017-02-27T04:17:17Z", "eventName": "DescribeConfigurationRecorderStatus", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "AWSCloudTrail, aws-internal/3", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAPRJFFJ12TBWPTY4U", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "793dba2a-780f-4f75-b9f6-23959b6ce902", "record_id": "flaws_cloudtrail:0000025:793dba2a-780f-4f75-b9f6-23959b6ce902", "row_index": 25, "timestamp": "2017-02-27T04:17:17Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAPRJFFJ12TBWPTY4U", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "AWSCloudTrail, aws-internal/3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 715, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "793dba2a-780f-4f75-b9f6-23959b6ce902", "eventTime": "2017-02-27T04:17:17Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "AWSCloudTrail, aws-internal/3", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAPRJFFJ12TBWPTY4U", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "92f1590e-cc74-4c99-82ec-72d3f01746a2", "record_id": "flaws_cloudtrail:0000026:92f1590e-cc74-4c99-82ec-72d3f01746a2", "row_index": 26, "timestamp": "2017-02-27T04:17:55Z", "event_type": "ListAccessKeys", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 689, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "92f1590e-cc74-4c99-82ec-72d3f01746a2", "eventTime": "2017-02-27T04:17:55Z", "eventName": "ListAccessKeys", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e9047ba9-2d16-469c-ba1b-5300352cbf02", "record_id": "flaws_cloudtrail:0000027:e9047ba9-2d16-469c-ba1b-5300352cbf02", "row_index": 27, "timestamp": "2017-02-27T04:17:55Z", "event_type": "GetAccountPasswordPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 819, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e9047ba9-2d16-469c-ba1b-5300352cbf02", "eventTime": "2017-02-27T04:17:55Z", "eventName": "GetAccountPasswordPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "The Password Policy with domain name 811596193553 cannot be found.", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f8c263eb-e97b-456c-b89a-57e7e74ed4d1", "record_id": "flaws_cloudtrail:0000028:f8c263eb-e97b-456c-b89a-57e7e74ed4d1", "row_index": 28, "timestamp": "2017-02-27T04:17:55Z", "event_type": "ListAccountAliases", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 693, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f8c263eb-e97b-456c-b89a-57e7e74ed4d1", "eventTime": "2017-02-27T04:17:55Z", "eventName": "ListAccountAliases", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf183b95-af34-40c1-887b-e3a11f11ada5", "record_id": "flaws_cloudtrail:0000029:bf183b95-af34-40c1-887b-e3a11f11ada5", "row_index": 29, "timestamp": "2017-02-27T04:17:55Z", "event_type": "ListMFADevices", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 689, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf183b95-af34-40c1-887b-e3a11f11ada5", "eventTime": "2017-02-27T04:17:55Z", "eventName": "ListMFADevices", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eac276048-f09c-4f86-bfd1-e2eeb2d84440", "record_id": "flaws_cloudtrail:0000030:eac276048-f09c-4f86-bfd1-e2eeb2d84440", "row_index": 30, "timestamp": "2017-02-27T04:17:55Z", "event_type": "GetAccountSummary", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 693, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eac276048-f09c-4f86-bfd1-e2eeb2d84440", "eventTime": "2017-02-27T04:17:55Z", "eventName": "GetAccountSummary", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8989da97-d777-46a4-89dc-36ae6b04691a", "record_id": "flaws_cloudtrail:0000031:8989da97-d777-46a4-89dc-36ae6b04691a", "row_index": 31, "timestamp": "2017-02-27T04:17:55Z", "event_type": "GetAccountSummary", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 691, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8989da97-d777-46a4-89dc-36ae6b04691a", "eventTime": "2017-02-27T04:17:55Z", "eventName": "GetAccountSummary", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "92f1590e-cc74-4c99-82ec-72d3f01746a2", "record_id": "flaws_cloudtrail:0000032:92f1590e-cc74-4c99-82ec-72d3f01746a2", "row_index": 32, "timestamp": "2017-02-27T04:17:55Z", "event_type": "ListAccessKeys", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 689, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "92f1590e-cc74-4c99-82ec-72d3f01746a2", "eventTime": "2017-02-27T04:17:55Z", "eventName": "ListAccessKeys", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eac276048-f09c-4f86-bfd1-e2eeb2d84440", "record_id": "flaws_cloudtrail:0000033:eac276048-f09c-4f86-bfd1-e2eeb2d84440", "row_index": 33, "timestamp": "2017-02-27T04:17:55Z", "event_type": "GetAccountSummary", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 693, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eac276048-f09c-4f86-bfd1-e2eeb2d84440", "eventTime": "2017-02-27T04:17:55Z", "eventName": "GetAccountSummary", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e9047ba9-2d16-469c-ba1b-5300352cbf02", "record_id": "flaws_cloudtrail:0000034:e9047ba9-2d16-469c-ba1b-5300352cbf02", "row_index": 34, "timestamp": "2017-02-27T04:17:55Z", "event_type": "GetAccountPasswordPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 819, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e9047ba9-2d16-469c-ba1b-5300352cbf02", "eventTime": "2017-02-27T04:17:55Z", "eventName": "GetAccountPasswordPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "The Password Policy with domain name 811596193553 cannot be found.", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f8c263eb-e97b-456c-b89a-57e7e74ed4d1", "record_id": "flaws_cloudtrail:0000035:f8c263eb-e97b-456c-b89a-57e7e74ed4d1", "row_index": 35, "timestamp": "2017-02-27T04:17:55Z", "event_type": "ListAccountAliases", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 693, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f8c263eb-e97b-456c-b89a-57e7e74ed4d1", "eventTime": "2017-02-27T04:17:55Z", "eventName": "ListAccountAliases", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf183b95-af34-40c1-887b-e3a11f11ada5", "record_id": "flaws_cloudtrail:0000036:bf183b95-af34-40c1-887b-e3a11f11ada5", "row_index": 36, "timestamp": "2017-02-27T04:17:55Z", "event_type": "ListMFADevices", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 689, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf183b95-af34-40c1-887b-e3a11f11ada5", "eventTime": "2017-02-27T04:17:55Z", "eventName": "ListMFADevices", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8989da97-d777-46a4-89dc-36ae6b04691a", "record_id": "flaws_cloudtrail:0000037:8989da97-d777-46a4-89dc-36ae6b04691a", "row_index": 37, "timestamp": "2017-02-27T04:17:55Z", "event_type": "GetAccountSummary", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 691, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8989da97-d777-46a4-89dc-36ae6b04691a", "eventTime": "2017-02-27T04:17:55Z", "eventName": "GetAccountSummary", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f393d533-3481-475e-9817-1c912ce819275", "record_id": "flaws_cloudtrail:0000038:f393d533-3481-475e-9817-1c912ce819275", "row_index": 38, "timestamp": "2017-02-27T04:17:56Z", "event_type": "ListAccountAliases", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 693, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f393d533-3481-475e-9817-1c912ce819275", "eventTime": "2017-02-27T04:17:56Z", "eventName": "ListAccountAliases", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "585fbba5-66eb-426d-84fd-f07abd625d0d", "record_id": "flaws_cloudtrail:0000039:585fbba5-66eb-426d-84fd-f07abd625d0d", "row_index": 39, "timestamp": "2017-02-27T04:17:56Z", "event_type": "ListAccessKeys", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 688, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "585fbba5-66eb-426d-84fd-f07abd625d0d", "eventTime": "2017-02-27T04:17:56Z", "eventName": "ListAccessKeys", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "01e8c936-32d0-4f57-a1e5-2a5e3692aff0", "record_id": "flaws_cloudtrail:0000040:01e8c936-32d0-4f57-a1e5-2a5e3692aff0", "row_index": 40, "timestamp": "2017-02-27T04:17:56Z", "event_type": "GetAccountPasswordPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 818, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "01e8c936-32d0-4f57-a1e5-2a5e3692aff0", "eventTime": "2017-02-27T04:17:56Z", "eventName": "GetAccountPasswordPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "The Password Policy with domain name 811596193553 cannot be found.", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d01615e2-7196-4c82-9912-d374024afb", "record_id": "flaws_cloudtrail:0000041:d01615e2-7196-4c82-9912-d374024afb", "row_index": 41, "timestamp": "2017-02-27T04:17:56Z", "event_type": "ListMFADevices", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 686, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d01615e2-7196-4c82-9912-d374024afb", "eventTime": "2017-02-27T04:17:56Z", "eventName": "ListMFADevices", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d01615e2-7196-4c82-9912-d374024afb", "record_id": "flaws_cloudtrail:0000042:d01615e2-7196-4c82-9912-d374024afb", "row_index": 42, "timestamp": "2017-02-27T04:17:56Z", "event_type": "ListMFADevices", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 686, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d01615e2-7196-4c82-9912-d374024afb", "eventTime": "2017-02-27T04:17:56Z", "eventName": "ListMFADevices", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "585fbba5-66eb-426d-84fd-f07abd625d0d", "record_id": "flaws_cloudtrail:0000043:585fbba5-66eb-426d-84fd-f07abd625d0d", "row_index": 43, "timestamp": "2017-02-27T04:17:56Z", "event_type": "ListAccessKeys", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 688, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "585fbba5-66eb-426d-84fd-f07abd625d0d", "eventTime": "2017-02-27T04:17:56Z", "eventName": "ListAccessKeys", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f393d533-3481-475e-9817-1c912ce819275", "record_id": "flaws_cloudtrail:0000044:f393d533-3481-475e-9817-1c912ce819275", "row_index": 44, "timestamp": "2017-02-27T04:17:56Z", "event_type": "ListAccountAliases", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 693, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f393d533-3481-475e-9817-1c912ce819275", "eventTime": "2017-02-27T04:17:56Z", "eventName": "ListAccountAliases", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "01e8c936-32d0-4f57-a1e5-2a5e3692aff0", "record_id": "flaws_cloudtrail:0000045:01e8c936-32d0-4f57-a1e5-2a5e3692aff0", "row_index": 45, "timestamp": "2017-02-27T04:17:56Z", "event_type": "GetAccountPasswordPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 818, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "01e8c936-32d0-4f57-a1e5-2a5e3692aff0", "eventTime": "2017-02-27T04:17:56Z", "eventName": "GetAccountPasswordPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "The Password Policy with domain name 811596193553 cannot be found.", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2a5f6d73-cb72-408c-9d16-22a895829", "record_id": "flaws_cloudtrail:0000046:2a5f6d73-cb72-408c-9d16-22a895829", "row_index": 46, "timestamp": "2017-02-27T04:17:58Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 693, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2a5f6d73-cb72-408c-9d16-22a895829", "eventTime": "2017-02-27T04:17:58Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"maxItems": 1000}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2a5f6d73-cb72-408c-9d16-22a895829", "record_id": "flaws_cloudtrail:0000047:2a5f6d73-cb72-408c-9d16-22a895829", "row_index": 47, "timestamp": "2017-02-27T04:17:58Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 693, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2a5f6d73-cb72-408c-9d16-22a895829", "eventTime": "2017-02-27T04:17:58Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"maxItems": 1000}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8cfacec8-f00b-4884-8a0f-eaaa20b29273", "record_id": "flaws_cloudtrail:0000048:8cfacec8-f00b-4884-8a0f-eaaa20b29273", "row_index": 48, "timestamp": "2017-02-27T04:18:00Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 715, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8cfacec8-f00b-4884-8a0f-eaaa20b29273", "eventTime": "2017-02-27T04:18:00Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8cfacec8-f00b-4884-8a0f-eaaa20b29273", "record_id": "flaws_cloudtrail:0000049:8cfacec8-f00b-4884-8a0f-eaaa20b29273", "row_index": 49, "timestamp": "2017-02-27T04:18:00Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 715, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8cfacec8-f00b-4884-8a0f-eaaa20b29273", "eventTime": "2017-02-27T04:18:00Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f03fd511-50f9-447f-8e29-e17c4668f8ee", "record_id": "flaws_cloudtrail:0000050:f03fd511-50f9-447f-8e29-e17c4668f8ee", "row_index": 50, "timestamp": "2017-02-27T04:18:01Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f03fd511-50f9-447f-8e29-e17c4668f8ee", "eventTime": "2017-02-27T04:18:01Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit", "versionId": "v7"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "08f217c8-cde4-4884-8b6e-03a54face426", "record_id": "flaws_cloudtrail:0000051:08f217c8-cde4-4884-8b6e-03a54face426", "row_index": 51, "timestamp": "2017-02-27T04:18:01Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "08f217c8-cde4-4884-8b6e-03a54face426", "eventTime": "2017-02-27T04:18:01Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit", "versionId": "v6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e7fa779a-0914-427c-89dc-0d2b8eec657d", "record_id": "flaws_cloudtrail:0000052:e7fa779a-0914-427c-89dc-0d2b8eec657d", "row_index": 52, "timestamp": "2017-02-27T04:18:01Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e7fa779a-0914-427c-89dc-0d2b8eec657d", "eventTime": "2017-02-27T04:18:01Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit", "versionId": "v5"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e169f091-7dad-4cae-8d9b-e27915945dc4", "record_id": "flaws_cloudtrail:0000053:e169f091-7dad-4cae-8d9b-e27915945dc4", "row_index": 53, "timestamp": "2017-02-27T04:18:01Z", "event_type": "ListPolicyVersions", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e169f091-7dad-4cae-8d9b-e27915945dc4", "eventTime": "2017-02-27T04:18:01Z", "eventName": "ListPolicyVersions", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit", "maxItems": 1000}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8098a8f0-6ba6-4089-a4e0-03ff9f77d997", "record_id": "flaws_cloudtrail:0000054:8098a8f0-6ba6-4089-a4e0-03ff9f77d997", "row_index": 54, "timestamp": "2017-02-27T04:18:01Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8098a8f0-6ba6-4089-a4e0-03ff9f77d997", "eventTime": "2017-02-27T04:18:01Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e120cb8b-5e9d-4c77-8879-232c1ff190969", "record_id": "flaws_cloudtrail:0000055:e120cb8b-5e9d-4c77-8879-232c1ff190969", "row_index": 55, "timestamp": "2017-02-27T04:18:01Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e120cb8b-5e9d-4c77-8879-232c1ff190969", "eventTime": "2017-02-27T04:18:01Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit", "versionId": "v2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff62abef-5a58-48de-b343-54657a006a9", "record_id": "flaws_cloudtrail:0000056:ff62abef-5a58-48de-b343-54657a006a9", "row_index": 56, "timestamp": "2017-02-27T04:18:01Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 755, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff62abef-5a58-48de-b343-54657a006a9", "eventTime": "2017-02-27T04:18:01Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit", "versionId": "v9"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ad434bc0-2178-4339-a584-01a464ad891d", "record_id": "flaws_cloudtrail:0000057:ad434bc0-2178-4339-a584-01a464ad891d", "row_index": 57, "timestamp": "2017-02-27T04:18:01Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ad434bc0-2178-4339-a584-01a464ad891d", "eventTime": "2017-02-27T04:18:01Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cf58acdd-2412-453c-96cd-e1b2a6a594d2", "record_id": "flaws_cloudtrail:0000058:cf58acdd-2412-453c-96cd-e1b2a6a594d2", "row_index": 58, "timestamp": "2017-02-27T04:18:01Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cf58acdd-2412-453c-96cd-e1b2a6a594d2", "eventTime": "2017-02-27T04:18:01Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit", "versionId": "v3"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "561774a9a-2e97-48bb-8fa2-7ad5ae6e8acd", "record_id": "flaws_cloudtrail:0000059:561774a9a-2e97-48bb-8fa2-7ad5ae6e8acd", "row_index": 59, "timestamp": "2017-02-27T04:18:01Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "561774a9a-2e97-48bb-8fa2-7ad5ae6e8acd", "eventTime": "2017-02-27T04:18:01Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit", "versionId": "v8"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3dd4ff79-921e-4df3-ae77-dc5e6e96f23b", "record_id": "flaws_cloudtrail:0000060:3dd4ff79-921e-4df3-ae77-dc5e6e96f23b", "row_index": 60, "timestamp": "2017-02-27T04:18:01Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 733, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3dd4ff79-921e-4df3-ae77-dc5e6e96f23b", "eventTime": "2017-02-27T04:18:01Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3dd4ff79-921e-4df3-ae77-dc5e6e96f23b", "record_id": "flaws_cloudtrail:0000061:3dd4ff79-921e-4df3-ae77-dc5e6e96f23b", "row_index": 61, "timestamp": "2017-02-27T04:18:01Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 733, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3dd4ff79-921e-4df3-ae77-dc5e6e96f23b", "eventTime": "2017-02-27T04:18:01Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8098a8f0-6ba6-4089-a4e0-03ff9f77d997", "record_id": "flaws_cloudtrail:0000062:8098a8f0-6ba6-4089-a4e0-03ff9f77d997", "row_index": 62, "timestamp": "2017-02-27T04:18:01Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8098a8f0-6ba6-4089-a4e0-03ff9f77d997", "eventTime": "2017-02-27T04:18:01Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e7fa779a-0914-427c-89dc-0d2b8eec657d", "record_id": "flaws_cloudtrail:0000063:e7fa779a-0914-427c-89dc-0d2b8eec657d", "row_index": 63, "timestamp": "2017-02-27T04:18:01Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e7fa779a-0914-427c-89dc-0d2b8eec657d", "eventTime": "2017-02-27T04:18:01Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit", "versionId": "v5"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "08f217c8-cde4-4884-8b6e-03a54face426", "record_id": "flaws_cloudtrail:0000064:08f217c8-cde4-4884-8b6e-03a54face426", "row_index": 64, "timestamp": "2017-02-27T04:18:01Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "08f217c8-cde4-4884-8b6e-03a54face426", "eventTime": "2017-02-27T04:18:01Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit", "versionId": "v6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f03fd511-50f9-447f-8e29-e17c4668f8ee", "record_id": "flaws_cloudtrail:0000065:f03fd511-50f9-447f-8e29-e17c4668f8ee", "row_index": 65, "timestamp": "2017-02-27T04:18:01Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f03fd511-50f9-447f-8e29-e17c4668f8ee", "eventTime": "2017-02-27T04:18:01Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit", "versionId": "v7"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "561774a9a-2e97-48bb-8fa2-7ad5ae6e8acd", "record_id": "flaws_cloudtrail:0000066:561774a9a-2e97-48bb-8fa2-7ad5ae6e8acd", "row_index": 66, "timestamp": "2017-02-27T04:18:01Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "561774a9a-2e97-48bb-8fa2-7ad5ae6e8acd", "eventTime": "2017-02-27T04:18:01Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit", "versionId": "v8"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff62abef-5a58-48de-b343-54657a006a9", "record_id": "flaws_cloudtrail:0000067:ff62abef-5a58-48de-b343-54657a006a9", "row_index": 67, "timestamp": "2017-02-27T04:18:01Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 755, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff62abef-5a58-48de-b343-54657a006a9", "eventTime": "2017-02-27T04:18:01Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit", "versionId": "v9"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e169f091-7dad-4cae-8d9b-e27915945dc4", "record_id": "flaws_cloudtrail:0000068:e169f091-7dad-4cae-8d9b-e27915945dc4", "row_index": 68, "timestamp": "2017-02-27T04:18:01Z", "event_type": "ListPolicyVersions", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e169f091-7dad-4cae-8d9b-e27915945dc4", "eventTime": "2017-02-27T04:18:01Z", "eventName": "ListPolicyVersions", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit", "maxItems": 1000}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ad434bc0-2178-4339-a584-01a464ad891d", "record_id": "flaws_cloudtrail:0000069:ad434bc0-2178-4339-a584-01a464ad891d", "row_index": 69, "timestamp": "2017-02-27T04:18:01Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ad434bc0-2178-4339-a584-01a464ad891d", "eventTime": "2017-02-27T04:18:01Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit", "versionId": "v1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e120cb8b-5e9d-4c77-8879-232c1ff190969", "record_id": "flaws_cloudtrail:0000070:e120cb8b-5e9d-4c77-8879-232c1ff190969", "row_index": 70, "timestamp": "2017-02-27T04:18:01Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e120cb8b-5e9d-4c77-8879-232c1ff190969", "eventTime": "2017-02-27T04:18:01Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit", "versionId": "v2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cf58acdd-2412-453c-96cd-e1b2a6a594d2", "record_id": "flaws_cloudtrail:0000071:cf58acdd-2412-453c-96cd-e1b2a6a594d2", "row_index": 71, "timestamp": "2017-02-27T04:18:01Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cf58acdd-2412-453c-96cd-e1b2a6a594d2", "eventTime": "2017-02-27T04:18:01Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"policyArn": "arn:aws:iam::aws:policy/SecurityAudit", "versionId": "v3"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "06d081e3-8eb0-4f74-91fb-81f700617119", "record_id": "flaws_cloudtrail:0000072:06d081e3-8eb0-4f74-91fb-81f700617119", "row_index": 72, "timestamp": "2017-02-27T05:02:15Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1479, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "06d081e3-8eb0-4f74-91fb-81f700617119", "eventTime": "2017-02-27T05:02:15Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAXDAXKM00D00ZF0RL", "expiration": "Feb 27, 2017 11:14:13 AM", "sessionToken": "FQoDYXdzED4aDBsoUS1PGcs6/9t9RSK3AyzjXvGmwUv8xgebAogDdUWeyab2PG73aQoOdECxwY4hcchtw53yp5Gm369t+be1oZhH57LZXyYL/YmG/D/REegFrbujmVgc8KA78/7ofuk+rjNAuAjrP2g94p9l5X/5/MB/Of6848jb3Lnkf9f369luLTfWQ9A8546CqdBlUg9keAN76PVSNyYzmLe/SAiPCt/L6dNWxjCqYzLyiklLZb4i2jXXHXhoPmcb4q/0sIS4tuL2XUUJjza+SbjAATruAKjoDuEl5DTZYwTLce0x/najnwICcMsqAXi37Flg0Kwmct72urAmoUScvaR+YUPeYCH0Ij/VJc9+WVHzYnWGMaMA1rqG86kKhYb8xJnXeUeVMlhUoIlZlZqapYiGs8T6acMUSCG5OwvABdeiDbm+j8DH1khopDTJHzLl6u7vn5MpQxFdRDahflaTYVaAxBXH8aB6HnktAW8lFLU2O8T9dulnQ3tAxuhAcQjQ8Xt9IW3aYFWzrKlWWXs4EnR9cHERbn/susAXpjN5OTp9iV8FY03Xk1OHLwbxr9TGnkYD1x2HKBX0/ZFJn65+MBnzRahcpzbx7EVsEFoo1+XOxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5ceef2da-0bc8-4021-bae7-d1a7ad09e247", "record_id": "flaws_cloudtrail:0000073:5ceef2da-0bc8-4021-bae7-d1a7ad09e247", "row_index": 73, "timestamp": "2017-02-27T05:41:22Z", "event_type": "GetAccountPasswordPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 819, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5ceef2da-0bc8-4021-bae7-d1a7ad09e247", "eventTime": "2017-02-27T05:41:22Z", "eventName": "GetAccountPasswordPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "The Password Policy with domain name 811596193553 cannot be found.", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2d6fed32-6b99-467d-adb7-b786490a46c", "record_id": "flaws_cloudtrail:0000074:2d6fed32-6b99-467d-adb7-b786490a46c", "row_index": 74, "timestamp": "2017-02-27T05:41:34Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 696, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2d6fed32-6b99-467d-adb7-b786490a46c", "eventTime": "2017-02-27T05:41:34Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"maxItems": 1000}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aca7010f-d274-4f41-afc6-476970b000972", "record_id": "flaws_cloudtrail:0000075:aca7010f-d274-4f41-afc6-476970b000972", "row_index": 75, "timestamp": "2017-02-27T05:41:37Z", "event_type": "GetAccountPasswordPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 819, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aca7010f-d274-4f41-afc6-476970b000972", "eventTime": "2017-02-27T05:41:37Z", "eventName": "GetAccountPasswordPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "The Password Policy with domain name 811596193553 cannot be found.", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "83a2878f-e2a8-43d9-8023-1193df824ac8", "record_id": "flaws_cloudtrail:0000076:83a2878f-e2a8-43d9-8023-1193df824ac8", "row_index": 76, "timestamp": "2017-02-27T05:41:40Z", "event_type": "ListOpenIDConnectProviders", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 700, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "83a2878f-e2a8-43d9-8023-1193df824ac8", "eventTime": "2017-02-27T05:41:40Z", "eventName": "ListOpenIDConnectProviders", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "543a5350-6511-4c3e-b69e-f8e23ba00925", "record_id": "flaws_cloudtrail:0000077:543a5350-6511-4c3e-b69e-f8e23ba00925", "row_index": 77, "timestamp": "2017-02-27T05:41:40Z", "event_type": "ListSAMLProviders", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 710, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "543a5350-6511-4c3e-b69e-f8e23ba00925", "eventTime": "2017-02-27T05:41:40Z", "eventName": "ListSAMLProviders", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "responseElements": {"sAMLProviderList": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cd1cbe92-7706-4430-9769-45d7195fba27", "record_id": "flaws_cloudtrail:0000078:cd1cbe92-7706-4430-9769-45d7195fba27", "row_index": 78, "timestamp": "2017-02-27T05:41:41Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 720, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cd1cbe92-7706-4430-9769-45d7195fba27", "eventTime": "2017-02-27T05:41:41Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"maxItems": 1000, "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d7c28aa0-3e5e-42e4-ba2e-e511e53c1182", "record_id": "flaws_cloudtrail:0000079:d7c28aa0-3e5e-42e4-ba2e-e511e53c1182", "row_index": 79, "timestamp": "2017-02-27T05:41:43Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d7c28aa0-3e5e-42e4-ba2e-e511e53c1182", "eventTime": "2017-02-27T05:41:43Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"maxItems": 1000}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d361f925-c091-43ba-af96-6fa496edbe3c", "record_id": "flaws_cloudtrail:0000080:d361f925-c091-43ba-af96-6fa496edbe3c", "row_index": 80, "timestamp": "2017-02-27T05:41:43Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 707, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d361f925-c091-43ba-af96-6fa496edbe3c", "eventTime": "2017-02-27T05:41:43Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"roleName": "flaws"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "42774c28-5cdc-44fe-a6a1-547050a5511", "record_id": "flaws_cloudtrail:0000081:42774c28-5cdc-44fe-a6a1-547050a5511", "row_index": 81, "timestamp": "2017-02-27T05:41:43Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 717, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "42774c28-5cdc-44fe-a6a1-547050a5511", "eventTime": "2017-02-27T05:41:43Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"roleName": "flaws"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "de7f286b-dc61-48c2-a363-c67b49e9bfc2", "record_id": "flaws_cloudtrail:0000082:de7f286b-dc61-48c2-a363-c67b49e9bfc2", "row_index": 82, "timestamp": "2017-02-27T05:41:43Z", "event_type": "ListRolePolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "de7f286b-dc61-48c2-a363-c67b49e9bfc2", "eventTime": "2017-02-27T05:41:43Z", "eventName": "ListRolePolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"roleName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5cf5708f-0d75-472e-9d37-f0d51e6aae5b", "record_id": "flaws_cloudtrail:0000083:5cf5708f-0d75-472e-9d37-f0d51e6aae5b", "row_index": 83, "timestamp": "2017-02-27T05:41:43Z", "event_type": "ListInstanceProfilesForRole", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 719, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5cf5708f-0d75-472e-9d37-f0d51e6aae5b", "eventTime": "2017-02-27T05:41:43Z", "eventName": "ListInstanceProfilesForRole", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"roleName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "918d6732-cf75-4b20-a3f7-3f3a6525a6ca", "record_id": "flaws_cloudtrail:0000084:918d6732-cf75-4b20-a3f7-3f3a6525a6ca", "row_index": 84, "timestamp": "2017-02-27T05:41:47Z", "event_type": "ListMFADevices", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 688, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "918d6732-cf75-4b20-a3f7-3f3a6525a6ca", "eventTime": "2017-02-27T05:41:47Z", "eventName": "ListMFADevices", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3ca13bde-62e8-4ffc-a976-f65c3aa8bb06", "record_id": "flaws_cloudtrail:0000085:3ca13bde-62e8-4ffc-a976-f65c3aa8bb06", "row_index": 85, "timestamp": "2017-02-27T05:41:47Z", "event_type": "ListAccountAliases", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 692, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3ca13bde-62e8-4ffc-a976-f65c3aa8bb06", "eventTime": "2017-02-27T05:41:47Z", "eventName": "ListAccountAliases", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0ceea890-d913-464f-90fc-3ce2a6d56710", "record_id": "flaws_cloudtrail:0000086:0ceea890-d913-464f-90fc-3ce2a6d56710", "row_index": 86, "timestamp": "2017-02-27T05:41:47Z", "event_type": "GetAccountPasswordPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 818, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0ceea890-d913-464f-90fc-3ce2a6d56710", "eventTime": "2017-02-27T05:41:47Z", "eventName": "GetAccountPasswordPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "The Password Policy with domain name 811596193553 cannot be found.", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "00c01156-752d-4f6f-8920-91a1cef25d9c", "record_id": "flaws_cloudtrail:0000087:00c01156-752d-4f6f-8920-91a1cef25d9c", "row_index": 87, "timestamp": "2017-02-27T05:41:47Z", "event_type": "GetAccountSummary", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 691, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "00c01156-752d-4f6f-8920-91a1cef25d9c", "eventTime": "2017-02-27T05:41:47Z", "eventName": "GetAccountSummary", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be09359-5541-4809-a974-82e615d0bc4e", "record_id": "flaws_cloudtrail:0000088:be09359-5541-4809-a974-82e615d0bc4e", "row_index": 88, "timestamp": "2017-02-27T05:41:47Z", "event_type": "ListAccessKeys", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 687, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be09359-5541-4809-a974-82e615d0bc4e", "eventTime": "2017-02-27T05:41:47Z", "eventName": "ListAccessKeys", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f21db38b-076b-4a01-ac4d-1e6ea7f5ce8f", "record_id": "flaws_cloudtrail:0000089:f21db38b-076b-4a01-ac4d-1e6ea7f5ce8f", "row_index": 89, "timestamp": "2017-02-27T05:41:57Z", "event_type": "ListMFADevices", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 689, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f21db38b-076b-4a01-ac4d-1e6ea7f5ce8f", "eventTime": "2017-02-27T05:41:57Z", "eventName": "ListMFADevices", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c66efe76-bc56-4793-951b-3aef89f83de4", "record_id": "flaws_cloudtrail:0000090:c66efe76-bc56-4793-951b-3aef89f83de4", "row_index": 90, "timestamp": "2017-02-27T05:41:57Z", "event_type": "GetAccountSummary", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 692, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c66efe76-bc56-4793-951b-3aef89f83de4", "eventTime": "2017-02-27T05:41:57Z", "eventName": "GetAccountSummary", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b4137d2b-56f5-481d-ad72-ef7728df2db9", "record_id": "flaws_cloudtrail:0000091:b4137d2b-56f5-481d-ad72-ef7728df2db9", "row_index": 91, "timestamp": "2017-02-27T05:41:57Z", "event_type": "GetAccountPasswordPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 819, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b4137d2b-56f5-481d-ad72-ef7728df2db9", "eventTime": "2017-02-27T05:41:57Z", "eventName": "GetAccountPasswordPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "errorCode": "NoSuchEntityException", "errorMessage": "The Password Policy with domain name 811596193553 cannot be found.", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a11d287f-6dd9-4146-987f-c8834faf9483", "record_id": "flaws_cloudtrail:0000092:a11d287f-6dd9-4146-987f-c8834faf9483", "row_index": 92, "timestamp": "2017-02-27T05:41:57Z", "event_type": "ListAccountAliases", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 692, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a11d287f-6dd9-4146-987f-c8834faf9483", "eventTime": "2017-02-27T05:41:57Z", "eventName": "ListAccountAliases", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "643ea8f3-8e91-42c5-9450-1bc870e3064d", "record_id": "flaws_cloudtrail:0000093:643ea8f3-8e91-42c5-9450-1bc870e3064d", "row_index": 93, "timestamp": "2017-02-27T05:41:57Z", "event_type": "ListAccessKeys", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 689, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "643ea8f3-8e91-42c5-9450-1bc870e3064d", "eventTime": "2017-02-27T05:41:57Z", "eventName": "ListAccessKeys", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c802fb0e-e242-4e93-af84-b3648ef6ea08", "record_id": "flaws_cloudtrail:0000094:c802fb0e-e242-4e93-af84-b3648ef6ea08", "row_index": 94, "timestamp": "2017-02-27T05:41:57Z", "event_type": "ListAccessKeys", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 689, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c802fb0e-e242-4e93-af84-b3648ef6ea08", "eventTime": "2017-02-27T05:41:57Z", "eventName": "ListAccessKeys", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d932d8e6-543c-4e85-a427-9d47fd72b675", "record_id": "flaws_cloudtrail:0000095:d932d8e6-543c-4e85-a427-9d47fd72b675", "row_index": 95, "timestamp": "2017-02-27T05:41:57Z", "event_type": "ListSigningCertificates", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 697, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d932d8e6-543c-4e85-a427-9d47fd72b675", "eventTime": "2017-02-27T05:41:57Z", "eventName": "ListSigningCertificates", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9bf68594-f408-4283-8182-a2db7e3186ea", "record_id": "flaws_cloudtrail:0000096:9bf68594-f408-4283-8182-a2db7e3186ea", "row_index": 96, "timestamp": "2017-02-27T05:42:07Z", "event_type": "UpdateAccessKey", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 744, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9bf68594-f408-4283-8182-a2db7e3186ea", "eventTime": "2017-02-27T05:42:07Z", "eventName": "UpdateAccessKey", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"status": "Inactive", "accessKeyId": "AKIAKZ5DMM2L61KYGILK"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "03a52481-24bb-43bf-9164-4f779c8f46fd", "record_id": "flaws_cloudtrail:0000097:03a52481-24bb-43bf-9164-4f779c8f46fd", "row_index": 97, "timestamp": "2017-02-27T05:42:21Z", "event_type": "UpdateAccessKey", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 741, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "03a52481-24bb-43bf-9164-4f779c8f46fd", "eventTime": "2017-02-27T05:42:21Z", "eventName": "UpdateAccessKey", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"status": "Active", "accessKeyId": "AKIAKZ5DMM2L61KYGILK"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "87518d9-80a0-4881-8c98-30a09bd1002a", "record_id": "flaws_cloudtrail:0000098:87518d9-80a0-4881-8c98-30a09bd1002a", "row_index": 98, "timestamp": "2017-02-27T05:43:00Z", "event_type": "UpdateAccessKey", "event_source": "iam.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAJMHFGREHBKC9VXH6", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 743, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "87518d9-80a0-4881-8c98-30a09bd1002a", "eventTime": "2017-02-27T05:43:00Z", "eventName": "UpdateAccessKey", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAJMHFGREHBKC9VXH6", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-26T17:48:22Z"}}}, "requestParameters": {"status": "Inactive", "accessKeyId": "AKIAKZ5DMM2L61KYGILK"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "62eb3838-c94e-44ef-9b31-164840bae95", "record_id": "flaws_cloudtrail:0000099:62eb3838-c94e-44ef-9b31-164840bae95", "row_index": 99, "timestamp": "2017-02-27T06:02:30Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1478, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "62eb3838-c94e-44ef-9b31-164840bae95", "eventTime": "2017-02-27T06:02:30Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAAA323S0DLE0JJV47", "expiration": "Feb 27, 2017 12:36:23 PM", "sessionToken": "FQoDYXdzED8aDOe2WUGL3rrymgWESSK3A1AZuJ2xiaLIz3ZlPFJ/m89b+U3N/C3+QL5VHy+iRw8cAvrQpomTz3RcXMEQPzdeJXdVJywLvw9cC+FdoDn0vHcKY8zTLZv2TrOwY/OU156sBE3jogjxI56dZ3IvbGLdOwVN0WeTVtFaVRrUJ5XgaicsRI+Q6ae1IAsPQfhB2ZpB7SnFfa10V5qM+QpTkmI1wOBNYCK4uILJQPZzGMqW1tZajnUV+rdZPcqcf0gyBbuWq05i7QE0O7bTH7RQttCN+mkBcVLl/uUt/ZwkKL8jnU9NV6y/UvSp8OTGbmA4YrOJDDhOcqurtDNjU9l4LXo1DvDvhXJDSv/wSJ7zsh2+TNXU2NFquBvGt+xGz+r9obqqi7Qgx5mFmNlA5Rsr0ye6p22SKU8PcnBGiZAkbsyrOEFzmMgg6uqFFNL4kt5w4frHd1pe+z1+NbX/24ydyqNSoyS7vju3CNTt/+NzopW+WutsOqOAheiRu5239GinqVxfZbCt7SXig3odrQFo1nsdBmdO4KAjb1M1/VQ7uW11Xk1jl5dySjFYDiUV4sp/UPKp7Y2qJWLJL2xx85Zn5cFTrHWoGUfO8OAo9oHPxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ce800e98-f824-43d3-8584-b8c28981", "record_id": "flaws_cloudtrail:0000100:ce800e98-f824-43d3-8584-b8c28981", "row_index": 100, "timestamp": "2017-02-27T06:04:23Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAZIX9Y7HJYESX8N5G", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "3.252.5.4", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1022, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ce800e98-f824-43d3-8584-b8c28981", "eventTime": "2017-02-27T06:04:23Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.252.5.4", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAZIX9Y7HJYESX8N5G", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-02-27T00:25:39Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logGroupName": "/aws/lambda/Level6", "logStreamName": "2017/02/27/[$LATEST]6c329048b9eea359fef7f7e210bcb2a2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "44589bc4-4a61-4c7b-b98f-ce88ebe3cb6e", "record_id": "flaws_cloudtrail:0000101:44589bc4-4a61-4c7b-b98f-ce88ebe3cb6e", "row_index": 101, "timestamp": "2017-02-27T07:02:31Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1478, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "44589bc4-4a61-4c7b-b98f-ce88ebe3cb6e", "eventTime": "2017-02-27T07:02:31Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAHET0NTKY8Y76I87B", "expiration": "Feb 27, 2017 1:25:05 PM", "sessionToken": "FQoDYXdzEEAaDP/gPTvp7+HFL5EnoiK3AySUcFroL3OLJBQrQ9IDlNb6aHKw9+XVApHPQ/hOssT9pP+n7Hkayxud6DZP4m3g2bWrbdIYhGrLZxPKZBPFEt5eiZCA7p3aY31C25IcOMEBjnbrlT2L23YSJZXdW4VgCakEGTlttmjbM+y61OPYJkDea0+Vpe48FkRO1rpL7WoIR2TtziuxDOZG4eKZ2xBtmmndyvLxD8Nc2pW5l9xGpFzHAVKDn0jCa53BR9s6wbjvEceFK0XqHMhYdGIKWNcjxgqDhIIzCGfXcBleuWH8q9qJyXx5fcLpaZnCpZ5S8sui/3dApNeLyDusxtlzj+XydOJdH+/WBeelDyKSWbGdW2jg/1EwHx5ZCMlRUay8VsYeyzBCxRI3C7DgrJndD90jV9jutmWl4PTLqOT79N8DbwskZv6CG42yYMWOSDGHp9kRtvCTDkgF9dhVwA/ZwFvj+FWl0+crWnh+n/xiM4IbVT9pZJ/v87qV2V29GYaKy31Z8i9H5MjuxhU1MFcaHGMYrLBgaxWbrWo0dh83MkcMP6kRq2ymTJ3wJLkTAF4Y7baoYQzn9Gd7RQaxwJ32veqG/OIhx/JBz6soh57PxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8df2d95d-44d5-4602-9ff5-ba3428def56c", "record_id": "flaws_cloudtrail:0000102:8df2d95d-44d5-4602-9ff5-ba3428def56c", "row_index": 102, "timestamp": "2017-02-27T08:03:07Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1478, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8df2d95d-44d5-4602-9ff5-ba3428def56c", "eventTime": "2017-02-27T08:03:07Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAXK8ACR9FAVYL2QLE", "expiration": "Feb 27, 2017 2:22:30 PM", "sessionToken": "FQoDYXdzEEEaDESPQuENgf89eDycgCK3A0BSu4kSN+ENwa8Fybixj1ASdt9SwsqR6AsA0MVAi2y0c0cNcA4qIz+Et6npUAvKxkS5YKJPhyVWJCoaxsw5t+AYCTHuT7n/+qHyDSj4hiZIfCG1Q/KIB+Ts1lKRXEdrCC7i9xAedsPWXFCNndQApQqYoB4jjcQ1YtUol0zM6QIhCJfPHR59Q/iGVy1Sp7mkJrLQ8PRJmynSMPI28vaLfx5cOFgwLpLARXOvPw2vk5ig/S9I74yT6Bac+Y98ABRzSp2vWsJh5bpAJqhkHRKd+g0pWK5MPaQNwBH8g7HYXlPi+NNKe+49biX0poSpUwWLksou+ip7xotJW/muVpL/6nT19F1Fvj4NdfuDRGGz/V0vl0PtSGEnWscsVpG+hqptEF4HtOvhNZ0BRcYOFwEWDJ9BkyClTIDIPaQdUlEBQ7M4CsJebD6T09rmg4IYOhHk3EX9WUQ7Nb0UM6Rw2Sa3JWQnHdKXiA+n3Xhrom+JFgxqBXsWbF/Gffr5ba4Lml+LuTGqftEUKJLur7EBRdtuozpLKvE4DDX+0N0diEFdpDQ9a0ZfMy/K1+1jEHH7teyhW1Fc9qYczO0ou7rPxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "74f49d88-ddc2-4db1-97ca-b18048cfed1d", "record_id": "flaws_cloudtrail:0000103:74f49d88-ddc2-4db1-97ca-b18048cfed1d", "row_index": 103, "timestamp": "2017-02-27T09:03:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1478, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "74f49d88-ddc2-4db1-97ca-b18048cfed1d", "eventTime": "2017-02-27T09:03:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIANJ4XDOY41CVFB3MU", "expiration": "Feb 27, 2017 3:25:08 PM", "sessionToken": "FQoDYXdzEEIaDCXh6XcnSJiFi3XqGyK3A/gB3djV8W3OmRJR7xBYcsTK6m4vSvp5Ks92/hhLC21fAvVbsRH67ymq2uHsY/HmnG5BlVriTM0ICOVHaUQqwwRgjWMF9AJg+cWjshYCWprIRNINtNxwqum/jLYnivLgYMb8scO+f4bkbQbvjymwL+vC0JnsdzXpgbX97bZCGOpglDxKtYLrpSoLHkfXGXfVdwmsBkDNZYgUS6LvW3zQEqvdADm3WjuTGY1JtL23m4TnoFcsEq3WzVrRdImCuSPv5jVDgexd+woH9d2XeED2/n2zU7EVl+XjHp31sHYPKOljVmhpLiHECzUR6za+S0FKwSxw/LTgtlyZQ181XCb+HK5FNcdbDJZlmCOe59ZFV1sQh8OijzP/M/+qSHSzce7x6ZJrkfQeQW9meLBFkuDDIKuuK4dX4S5TUssF56S+67ePnYEK2kRXe3Xoyx3Juw765dpgrljRkLtwkNegYYRXvtW2JUg4ZaDsN6zeCCStLpFN4ggBynlMwUbYyzPkDCyi89fvUNnBkO9map0UW2H9+wEYILmPhhEZcyTtUnK/Hg1+bh1DWXemW4dbC/5dBooW7/QYm4FJoico0NbPxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eb28b97b-ffa0-4dca-84f6-fdc6c04728", "record_id": "flaws_cloudtrail:0000104:eb28b97b-ffa0-4dca-84f6-fdc6c04728", "row_index": 104, "timestamp": "2017-02-27T09:43:19Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "1.201.101.6", "user_agent": "[aws-cli/1.11.50 Python/2.7.13 Darwin/15.4.0 botocore/1.5.13]", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 639, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eb28b97b-ffa0-4dca-84f6-fdc6c04728", "eventTime": "2017-02-27T09:43:19Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "1.201.101.6", "userAgent": "[aws-cli/1.11.50 Python/2.7.13 Darwin/15.4.0 botocore/1.5.13]", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8260ddea-e43d-4f23-996b-bc765ca291cb", "record_id": "flaws_cloudtrail:0000105:8260ddea-e43d-4f23-996b-bc765ca291cb", "row_index": 105, "timestamp": "2017-02-27T10:03:38Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1478, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8260ddea-e43d-4f23-996b-bc765ca291cb", "eventTime": "2017-02-27T10:03:38Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAUWT3BP9PIIXEY0P6", "expiration": "Feb 27, 2017 4:15:10 PM", "sessionToken": "FQoDYXdzEEMaDHt7NeJR0xRDdSYlFiK3A+qx/iGGCNssd8U1DjoOl+jP7Pw6a8BGdQ4aMGVYM2f189T4DYNbGLioTJaplNr5S29dXyM3vlYfhCMoDQbWLDYS8CqKb/KOQTJQvKAyEq/DVUTlNQEAg4PILb8mV49SLMBy5cXcpJfk2aUtE7viQaibT3/JZe77BAYJ+xv4hXho1u8eVu0ES1OVwiQmi3EwNQPIc9uYzcC86DsaA1ONgjXwE+cMQmxdRD7sFv9Q3qn+jLX/GVH1pDeyuXcKCTBMy45mBgL46I8tv08KB/3upiX9BJns/Ii8bXUe18vnaDyLowfLYlpBy3xVtvLm3AtlpvJfApBTsYvGvS1KWe7pUZ8uZJWqtMUj7BHeXTrHcX+r77bvHMvA8Bm7iPJuYrVnyMiG3qwwKf/cLeNB5vHFaMDbXmQaP5UwfIE4HqpVfAkXeWvim8CWVznORWzZm6dgKZ68StMd4PEeftJF/xnNETl8O6WWnzxCnJJRKiPhgqRewh2uwAsPUU6mdgVW3F6tSmmhRpx/SbtstPyCaCa2dE2uJYPp9ewPaWD0m79qVeBJ6t7swyc3OZlO+6o/7S0M6eG/VtxDjw0o+vLPxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7c641efc-1aad-4c38-b221-4b40cd63855e", "record_id": "flaws_cloudtrail:0000106:7c641efc-1aad-4c38-b221-4b40cd63855e", "row_index": 106, "timestamp": "2017-02-27T10:32:54Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIAP0ARJT2N9GOJOE0V", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "100.174.62.157", "user_agent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 505, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7c641efc-1aad-4c38-b221-4b40cd63855e", "eventTime": "2017-02-27T10:32:54Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "100.174.62.157", "userAgent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIAP0ARJT2N9GOJOE0V", "userName": "Level6"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b9440da9-13ba-4dde-87fe-19e14adc7f10", "record_id": "flaws_cloudtrail:0000107:b9440da9-13ba-4dde-87fe-19e14adc7f10", "row_index": 107, "timestamp": "2017-02-27T10:33:34Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIAP0ARJT2N9GOJOE0V", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "100.174.62.157", "user_agent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 534, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b9440da9-13ba-4dde-87fe-19e14adc7f10", "eventTime": "2017-02-27T10:33:34Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "100.174.62.157", "userAgent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIAP0ARJT2N9GOJOE0V", "userName": "Level6"}, "requestParameters": {"maxItems": 100}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "92f667ea-c552-4390-9e3e-59c5dbf5d87b", "record_id": "flaws_cloudtrail:0000108:92f667ea-c552-4390-9e3e-59c5dbf5d87b", "row_index": 108, "timestamp": "2017-02-27T10:34:52Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIAP0ARJT2N9GOJOE0V", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "100.174.62.157", "user_agent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 534, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "92f667ea-c552-4390-9e3e-59c5dbf5d87b", "eventTime": "2017-02-27T10:34:52Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "100.174.62.157", "userAgent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIAP0ARJT2N9GOJOE0V", "userName": "Level6"}, "requestParameters": {"maxItems": 100}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e605fbd3-c54c-4a69-bd55-061b290525b8", "record_id": "flaws_cloudtrail:0000109:e605fbd3-c54c-4a69-bd55-061b290525b8", "row_index": 109, "timestamp": "2017-02-27T10:35:32Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIAP0ARJT2N9GOJOE0V", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "100.174.62.157", "user_agent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 537, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e605fbd3-c54c-4a69-bd55-061b290525b8", "eventTime": "2017-02-27T10:35:32Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "100.174.62.157", "userAgent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIAP0ARJT2N9GOJOE0V", "userName": "Level6"}, "requestParameters": {"maxItems": 100}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "01df0347-8d7e-4aa1-82c7-0794357f6b80", "record_id": "flaws_cloudtrail:0000110:01df0347-8d7e-4aa1-82c7-0794357f6b80", "row_index": 110, "timestamp": "2017-02-27T10:36:15Z", "event_type": "ListGroups", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIAP0ARJT2N9GOJOE0V", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "100.174.62.157", "user_agent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 535, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "01df0347-8d7e-4aa1-82c7-0794357f6b80", "eventTime": "2017-02-27T10:36:15Z", "eventName": "ListGroups", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "100.174.62.157", "userAgent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIAP0ARJT2N9GOJOE0V", "userName": "Level6"}, "requestParameters": {"maxItems": 100}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "68127081-e6b9-4665-9df1-60f243b820ff", "record_id": "flaws_cloudtrail:0000111:68127081-e6b9-4665-9df1-60f243b820ff", "row_index": 111, "timestamp": "2017-02-27T10:37:10Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIAP0ARJT2N9GOJOE0V", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "100.174.62.157", "user_agent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 505, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "68127081-e6b9-4665-9df1-60f243b820ff", "eventTime": "2017-02-27T10:37:10Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "100.174.62.157", "userAgent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIAP0ARJT2N9GOJOE0V", "userName": "Level6"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "facf9cb5-72ec-4056-8cfa-ce556eb01503", "record_id": "flaws_cloudtrail:0000112:facf9cb5-72ec-4056-8cfa-ce556eb01503", "row_index": 112, "timestamp": "2017-02-27T10:37:44Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIAP0ARJT2N9GOJOE0V", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "100.174.62.157", "user_agent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 500, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "facf9cb5-72ec-4056-8cfa-ce556eb01503", "eventTime": "2017-02-27T10:37:44Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "100.174.62.157", "userAgent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIAP0ARJT2N9GOJOE0V", "userName": "Level6"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "440bb861-bd44-4ab5-b577-055f6bece2b7", "record_id": "flaws_cloudtrail:0000113:440bb861-bd44-4ab5-b577-055f6bece2b7", "row_index": 113, "timestamp": "2017-02-27T10:39:04Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIAP0ARJT2N9GOJOE0V", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "100.174.62.157", "user_agent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 510, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "440bb861-bd44-4ab5-b577-055f6bece2b7", "eventTime": "2017-02-27T10:39:04Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "100.174.62.157", "userAgent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIAP0ARJT2N9GOJOE0V", "userName": "Level6"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "22520c17-3f85-42b1-91a4-f095bfa71cb3", "record_id": "flaws_cloudtrail:0000114:22520c17-3f85-42b1-91a4-f095bfa71cb3", "row_index": 114, "timestamp": "2017-02-27T10:39:48Z", "event_type": "DescribeKeyPairs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIAP0ARJT2N9GOJOE0V", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "100.174.62.157", "user_agent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 504, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "22520c17-3f85-42b1-91a4-f095bfa71cb3", "eventTime": "2017-02-27T10:39:48Z", "eventName": "DescribeKeyPairs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "100.174.62.157", "userAgent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIAP0ARJT2N9GOJOE0V", "userName": "Level6"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "049382a6-f6ea-4adf-9d53-b8fd9c626185", "record_id": "flaws_cloudtrail:0000115:049382a6-f6ea-4adf-9d53-b8fd9c626185", "row_index": 115, "timestamp": "2017-02-27T10:40:28Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIAP0ARJT2N9GOJOE0V", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "100.174.62.157", "user_agent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 498, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "049382a6-f6ea-4adf-9d53-b8fd9c626185", "eventTime": "2017-02-27T10:40:28Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "100.174.62.157", "userAgent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIAP0ARJT2N9GOJOE0V", "userName": "Level6"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8abffe7c-4f88-4c44-93bb-dc92b0724fa6", "record_id": "flaws_cloudtrail:0000116:8abffe7c-4f88-4c44-93bb-dc92b0724fa6", "row_index": 116, "timestamp": "2017-02-27T10:41:11Z", "event_type": "ListFunctions", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIAP0ARJT2N9GOJOE0V", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "100.174.62.157", "user_agent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 504, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8abffe7c-4f88-4c44-93bb-dc92b0724fa6", "eventTime": "2017-02-27T10:41:11Z", "eventName": "ListFunctions", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "100.174.62.157", "userAgent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIAP0ARJT2N9GOJOE0V", "userName": "Level6"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "14f91e55-66d7-4284-a798-8411f1fbc0ce", "record_id": "flaws_cloudtrail:0000117:14f91e55-66d7-4284-a798-8411f1fbc0ce", "row_index": 117, "timestamp": "2017-02-27T10:42:46Z", "event_type": "DescribeDBInstances", "event_source": "rds.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIAP0ARJT2N9GOJOE0V", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "100.174.62.157", "user_agent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 507, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "14f91e55-66d7-4284-a798-8411f1fbc0ce", "eventTime": "2017-02-27T10:42:46Z", "eventName": "DescribeDBInstances", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "100.174.62.157", "userAgent": "Botocore/1.21.21 Python/3.8.10 Linux/5.4.0-90-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIAP0ARJT2N9GOJOE0V", "userName": "Level6"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fc59a4e3-25e9-4739-9544-eedf885438f37", "record_id": "flaws_cloudtrail:0000118:fc59a4e3-25e9-4739-9544-eedf885438f37", "row_index": 118, "timestamp": "2017-02-27T11:05:01Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1479, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fc59a4e3-25e9-4739-9544-eedf885438f37", "eventTime": "2017-02-27T11:05:01Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA3RISZMW5Y705IBN3", "expiration": "Feb 27, 2017 5:21:13 PM", "sessionToken": "FQoDYXdzEEQaDNSxFpt6MxF3KUeTKiK3A+/cvr/tH31Ulzq7hCJ4bYKhBy62FlqrxQAm774eAcNu/dfk9puZESBMLXrWiaes/bidSkWNXgLIpD3AxYaKly3tKPh+hAvswDbIAIpO33zdy0K0oq5fXac36KIx/sfdW2HbjsK5BfV1ZMK4vZa6zT6glBTI5rv+nZbGs7qldbuLvyOkEPiORWiDH/zbBai5kG+nArU89xp2nlJErq24J/JwbmJZhIvM1FGPMiv66KdbO+KkSYqXIcr4ScTR4nhqa9yHJGn7bPPXTU39sNpkm0gF/gzGHNW6MIxPI+2k0Kv/DglSZlnLhxlzZlFREcv8d/lDjtSdRvxh+RRFAlw+9u3lkMTZJntZr6xfmsOw+RsjTvyZkXO3jT4sdSJQTcLJJ7hMvtn7RyehF3X8no5vTlkM4KwslkIPRGgI0hAcAjZG0XTRMFN5Emsv5wdXKvxVyIWwHaiC6RX/MDgzD10/aWnASvlS1N22I6gFn4jsv7z542hjCCgS4Fk1sFDKDJuTnrIDRqYtW2M4kL/znWQa4proLb/hwczIdZ9QCrO7DJHHfUnQCn3GxVlm97zgzcb6BASY3FDXrV0o3Y/QxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "07057af-c98b-48f3-813d-f4173376b506", "record_id": "flaws_cloudtrail:0000119:07057af-c98b-48f3-813d-f4173376b506", "row_index": 119, "timestamp": "2017-02-27T11:25:40Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1214, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "07057af-c98b-48f3-813d-f4173376b506", "eventTime": "2017-02-27T11:25:40Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIADELCQ6TDBEO9DS4H", "expiration": "Feb 27, 2017 11:25:40 PM", "sessionToken": "FQoDYXdzEEUaDJv8RsNum6kubh0iXyLfAQK8tNV3T5t+Ym02vRm5DKf7A56n1a+WwI+2fm5RhfT6BMG5pO7PtGL192mMwM0c3SWGGgBodHiYLyBfWZBDb8mRnXlLxWG1+JETQ06WXbSd6YIx1Zp96PeIwde6PMZu1pJr/UyJd1v1IP5wT7qAh6s5HDuVA6QhdcB+vgK4Ss3zr5EJx3ymlijgIyybjnpwto1+ngZXTVWH3AkYzXVO6Ji0/WNBHJ6GyYwHrAylcgPwAfSDTgIi/aNgFdsR5otZkjSNeWiDe3S4lT+o6LO/gN17HgRAbGZcQZpM8xpq65gotJnQxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "516198d8d-26c2-4671-8cf5-c2e343320b56", "record_id": "flaws_cloudtrail:0000120:516198d8d-26c2-4671-8cf5-c2e343320b56", "row_index": 120, "timestamp": "2017-02-27T11:25:40Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIADELCQ6TDBEO9DS4H", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "95.237.217.250", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1032, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "516198d8d-26c2-4671-8cf5-c2e343320b56", "eventTime": "2017-02-27T11:25:40Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.237.217.250", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIADELCQ6TDBEO9DS4H", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-02-27T11:25:40Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logGroupName": "/aws/lambda/Level6", "logStreamName": "2017/02/27/[$LATEST]9c1c3c1f996421bcf5d60732c4b82673"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "54fcf6dc-2d82-469e-8987-17a68c5aaa1e", "record_id": "flaws_cloudtrail:0000121:54fcf6dc-2d82-469e-8987-17a68c5aaa1e", "row_index": 121, "timestamp": "2017-02-27T12:04:50Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.145.253.230", "user_agent": "[aws-cli/1.11.48 Python/2.7.10 Darwin/15.6.0 botocore/1.5.11]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 643, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "54fcf6dc-2d82-469e-8987-17a68c5aaa1e", "eventTime": "2017-02-27T12:04:50Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.145.253.230", "userAgent": "[aws-cli/1.11.48 Python/2.7.10 Darwin/15.6.0 botocore/1.5.11]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8f90b7d2-c8af-4ef1-9a96-bd543b0eff15", "record_id": "flaws_cloudtrail:0000122:8f90b7d2-c8af-4ef1-9a96-bd543b0eff15", "row_index": 122, "timestamp": "2017-02-27T12:05:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1479, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8f90b7d2-c8af-4ef1-9a96-bd543b0eff15", "eventTime": "2017-02-27T12:05:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAKSZSWMEAGW75LNN4", "expiration": "Feb 27, 2017 6:39:07 PM", "sessionToken": "FQoDYXdzEEUaDBMK3rsjcAuQ80PMFiK3A6fqkGJmFeYXohXuZBBWqL4TF8IvBx7a4lEpI+WXt/ccMhtupFimgcfSqGPS3LEL14pFH+aXawz1pZvWykF0Powzsq5mz3AanfYzxcURiKboVwWqcQR4jBCOjIE15IWs1+CB0b8g5adiiG8CWilZCR42enfIZ5sK5nh5uGlaYH+3kWaoAfqRC4aGiVqjy1Dg+aEteg9VXFcat8PmkC7guNvM8wed3wJxIFN+qnWzMYWu/X+bBr3KnKwCuVNnWdSxyHXMvi89iceVVTIYfeyKdfA37NX60a74i3Y/2HXdNVMzxoDYs9ZkOMAJgNEZ8l3LOjX+qHjTf2chzlyAEHlpGY5YfwK7CCtAeIOPPh3SG2zxrdq/RbdlR19YGgxa+GrcBR7fxeciZciaL8o81qrwc3A7Dmt3a7uRuwugcmL6myJktd69dCQDAgupTfZqNU8lYc+DevtP2j7adJxvynRDndNyK/fKM58tiwDVdy3vBs4vhthmYuzaeS0C7gzgM2x7oyBej8pDbYju2Ghk4QVCKqhJZXmABmrx6ykyhDE/iUyyfW/pNmPv7nD2q8k6hSwZUWyQzkKYjEAo8KvQxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7e88d70a-9d05-42b5-a176-a7a5b036365", "record_id": "flaws_cloudtrail:0000123:7e88d70a-9d05-42b5-a176-a7a5b036365", "row_index": 123, "timestamp": "2017-02-27T12:05:23Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.145.253.230", "user_agent": "aws-cli/1.11.48 Python/2.7.10 Darwin/15.6.0 botocore/1.5.11", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 768, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7e88d70a-9d05-42b5-a176-a7a5b036365", "eventTime": "2017-02-27T12:05:23Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.145.253.230", "userAgent": "aws-cli/1.11.48 Python/2.7.10 Darwin/15.6.0 botocore/1.5.11", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8afe1307-cb1d-4e8d-9e08-34623e56022", "record_id": "flaws_cloudtrail:0000124:8afe1307-cb1d-4e8d-9e08-34623e56022", "row_index": 124, "timestamp": "2017-02-27T12:06:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.145.253.230", "user_agent": "aws-cli/1.11.48 Python/2.7.10 Darwin/15.6.0 botocore/1.5.11", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8afe1307-cb1d-4e8d-9e08-34623e56022", "eventTime": "2017-02-27T12:06:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.145.253.230", "userAgent": "aws-cli/1.11.48 Python/2.7.10 Darwin/15.6.0 botocore/1.5.11", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9c904f74-09e0-4f05-be13-51ca32e21a0a", "record_id": "flaws_cloudtrail:0000125:9c904f74-09e0-4f05-be13-51ca32e21a0a", "row_index": 125, "timestamp": "2017-02-27T12:06:12Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.145.253.230", "user_agent": "aws-cli/1.11.48 Python/2.7.10 Darwin/15.6.0 botocore/1.5.11", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1041, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9c904f74-09e0-4f05-be13-51ca32e21a0a", "eventTime": "2017-02-27T12:06:12Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.145.253.230", "userAgent": "aws-cli/1.11.48 Python/2.7.10 Darwin/15.6.0 botocore/1.5.11", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJsbFJFRTRWeCt2VlBpTVh1MUxBaG9Sa0dRY0xqUEFzamRnRC9MVmczOGlJMVEzK0lWZVFBMXpXUXplVjBNWGtnMEdJN0laeUdhMkNxdFZCWmdMY0lPcVIxdHJIYndrL2xKSGFZcWozU0JhSG56eFdoYlN2dnZZRm83RHYwb0h0SS9aTFlwR3UyQ1k5cE13OEcxZkVUcXc9PSIsImkiOiJwaEVVVVlGMUtjQ1hPZXhkU3prbFpnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b54cbeb4-c449-4778-ad46-730d12736b1e", "record_id": "flaws_cloudtrail:0000126:b54cbeb4-c449-4778-ad46-730d12736b1e", "row_index": 126, "timestamp": "2017-02-27T12:06:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.145.253.230", "user_agent": "aws-cli/1.11.48 Python/2.7.10 Darwin/15.6.0 botocore/1.5.11", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1041, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b54cbeb4-c449-4778-ad46-730d12736b1e", "eventTime": "2017-02-27T12:06:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.145.253.230", "userAgent": "aws-cli/1.11.48 Python/2.7.10 Darwin/15.6.0 botocore/1.5.11", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJaZEU5eWgrYnFqa3hrZEF2RWxTejhSaDdXM2wwOUJIVW0vQzVpNkM0NGI3U2p2ZGd2MHNxMi9NUzcwSHR0Q24zek94Nm1KVGRzUjFHdk4weGdCa3h2UWpkVVluNHB6WFNHMEVsSTNiNndWWHZNaFBnZjdZL1hUZEltd3JaekpGR0w4UVhxUytXZDZJcVlLcmM0SEtBT3c9PSIsImkiOiJBQjFMQTQ0VlZJUU9mQTRmWEVqeGRBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f4e6b16a-9b4d-45d1-948e-1d643c8036f4", "record_id": "flaws_cloudtrail:0000127:f4e6b16a-9b4d-45d1-948e-1d643c8036f4", "row_index": 127, "timestamp": "2017-02-27T12:06:35Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.145.253.230", "user_agent": "aws-cli/1.11.48 Python/2.7.10 Darwin/15.6.0 botocore/1.5.11", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1040, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f4e6b16a-9b4d-45d1-948e-1d643c8036f4", "eventTime": "2017-02-27T12:06:35Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.145.253.230", "userAgent": "aws-cli/1.11.48 Python/2.7.10 Darwin/15.6.0 botocore/1.5.11", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJEOVgzQ0l4UmdxYXkwNWhmRWZZQzlYM2JubnFXaHhCbDFaNHZmcWorclZlR3dWNmRNWUt1VHNKa3krbGU3TEtzZVYzUHRCT2RyRGlYK1YxM3ptMkdYM0tDQkRDSVg2YlY4UnR0b3ljcUo1M3kvcHVlL0dEQnpCSmc5SVowR2JmR2pBQnVEbWVXTE9iOGYxcGFFMC9ObXc9PSIsImkiOiJkOWVvdE1zQi9INC8zMFFkbXFQbS9nPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac0f1ffd-c452-49a0-a5f4-153be2f44f1c", "record_id": "flaws_cloudtrail:0000128:ac0f1ffd-c452-49a0-a5f4-153be2f44f1c", "row_index": 128, "timestamp": "2017-02-27T12:06:41Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.145.253.230", "user_agent": "aws-cli/1.11.48 Python/2.7.10 Darwin/15.6.0 botocore/1.5.11", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1041, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac0f1ffd-c452-49a0-a5f4-153be2f44f1c", "eventTime": "2017-02-27T12:06:41Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.145.253.230", "userAgent": "aws-cli/1.11.48 Python/2.7.10 Darwin/15.6.0 botocore/1.5.11", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJnaitkdDZBNFpOeVE3anVoMlB2UWgrZU9SbUQxZU1Zclg3SEx6Y2dUWFhEeXBHOTJ4b1hyeisxb3RoQ2xtNlhqUGl3UUlyVnc5THB3enBHN1B0eEErbVZ4UWhaLzh3Q3pGdFpVOVprWFU3VWJldjFlQVErenl6dk15M1ZtSk8ydkpQNXFoRHpiU1lVY1Y3QTFzbDA5U1E9PSIsImkiOiJtZy8wRHJBRUYzNzNuQUNVM1Z2RVpRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f58137-46e4-4aa8-81d2-e199830a74017", "record_id": "flaws_cloudtrail:0000129:f58137-46e4-4aa8-81d2-e199830a74017", "row_index": 129, "timestamp": "2017-02-27T12:06:50Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.145.253.230", "user_agent": "aws-cli/1.11.48 Python/2.7.10 Darwin/15.6.0 botocore/1.5.11", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1040, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f58137-46e4-4aa8-81d2-e199830a74017", "eventTime": "2017-02-27T12:06:50Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.145.253.230", "userAgent": "aws-cli/1.11.48 Python/2.7.10 Darwin/15.6.0 botocore/1.5.11", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJHMXI0SDBGTDBvazJTclFKWGx3WU1sMGpTMUUvVmpJVTRDR3QwMm5tRjJvZWFORG03WGd1dVFrR0NtcThSWDhXZjNLWVpkK3hyWGtHWGErR3B2N25KNlBBSFk5QXlOSml5WkhtQVg3QlBWajZ1WXN1bGEzYmdvQzZzNjJPTFVYUE84MlNqZkhRbmIyOWNyRHlSa1VxeGc9PSIsImkiOiIxcHJrRExWWlhKZ2R0dVJDU0xsVTZ3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ae89561f-bd88-4147-989e-e6029064ab85", "record_id": "flaws_cloudtrail:0000130:ae89561f-bd88-4147-989e-e6029064ab85", "row_index": 130, "timestamp": "2017-02-27T12:06:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.145.253.230", "user_agent": "aws-cli/1.11.48 Python/2.7.10 Darwin/15.6.0 botocore/1.5.11", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1041, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ae89561f-bd88-4147-989e-e6029064ab85", "eventTime": "2017-02-27T12:06:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.145.253.230", "userAgent": "aws-cli/1.11.48 Python/2.7.10 Darwin/15.6.0 botocore/1.5.11", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiI2dXBOYm04QkJDMlRUOCtFNThudTdxdVNQcVBwSU80OHd5ZDR3dmloMVlNOFlrVkkxSmhvYzlSYzIvelpqMGtYb2w3ZjJOTlZ1MVNmem5yekdoeE91QWdmNmJJcU5KNU82RTZLNzBWVlcxWnBSMlgzK2l1b3E5MW9wb0Znc3BHVWl0NjZGa3JvZW9RaUE4ZTBmcHBnS0E9PSIsImkiOiJSdEU5bnUvUHFlWEg2UXZEZVkzaWRnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9e8a5e33-3150-43d8-af57-13e2c9432a19", "record_id": "flaws_cloudtrail:0000131:9e8a5e33-3150-43d8-af57-13e2c9432a19", "row_index": 131, "timestamp": "2017-02-27T12:07:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.145.253.230", "user_agent": "aws-cli/1.11.48 Python/2.7.10 Darwin/15.6.0 botocore/1.5.11", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1041, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9e8a5e33-3150-43d8-af57-13e2c9432a19", "eventTime": "2017-02-27T12:07:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.145.253.230", "userAgent": "aws-cli/1.11.48 Python/2.7.10 Darwin/15.6.0 botocore/1.5.11", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJRSElQVWF4QlJFZm8weS9HaS9HRjNaRmxJNUR6VEdPbHc5K3o3cDdRVFpXdG1wM3cxTXNwekZBUGVpMUl1UjZGd2tUa0ZaandpaGhlVTlnekxqS1dreGptWnpvUU9QTWdaUTJhQit1TGtCMGtWYWV1WTJ4cjFhcFloNVg0MXRYb1Z5YXRRT1dSUFlibDMyM20zZ1RDNmc9PSIsImkiOiJsWGZ2UUR6OGN0cVM2bmlqNGVyWFNRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c343895-c5ce-460b-a85d-b29d6fb11ea8", "record_id": "flaws_cloudtrail:0000132:c343895-c5ce-460b-a85d-b29d6fb11ea8", "row_index": 132, "timestamp": "2017-02-27T12:07:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.145.253.230", "user_agent": "aws-cli/1.11.48 Python/2.7.10 Darwin/15.6.0 botocore/1.5.11", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c343895-c5ce-460b-a85d-b29d6fb11ea8", "eventTime": "2017-02-27T12:07:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.145.253.230", "userAgent": "aws-cli/1.11.48 Python/2.7.10 Darwin/15.6.0 botocore/1.5.11", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "222498a99-11a3-45c1-8a1e-179552bfad54", "record_id": "flaws_cloudtrail:0000133:222498a99-11a3-45c1-8a1e-179552bfad54", "row_index": 133, "timestamp": "2017-02-27T12:12:06Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIADELCQ6TDBEO9DS4H", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "121.171.1.24", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1030, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "222498a99-11a3-45c1-8a1e-179552bfad54", "eventTime": "2017-02-27T12:12:06Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "121.171.1.24", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIADELCQ6TDBEO9DS4H", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-02-27T11:25:40Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logGroupName": "/aws/lambda/Level6", "logStreamName": "2017/02/27/[$LATEST]7aa9fbc8f0c32f83078f71ecd39412b1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "37dc4ecc-84d6-483f-8ecc-e4eb78872b8f", "record_id": "flaws_cloudtrail:0000134:37dc4ecc-84d6-483f-8ecc-e4eb78872b8f", "row_index": 134, "timestamp": "2017-02-27T13:06:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1478, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "37dc4ecc-84d6-483f-8ecc-e4eb78872b8f", "eventTime": "2017-02-27T13:06:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAD6ZM8IAMEBNSNS4B", "expiration": "Feb 27, 2017 7:30:51 PM", "sessionToken": "FQoDYXdzEEYaDJmIurBSH3vcRLcboSK3Az6nHF2VP07yYBEZT7vyXOgdpt3DA0Q2RNLrspKyAHnjs46HZjJkgYQVqYFCRgnQ4oNUIJQQMD/1Ge9XGClrXNYUDpF1VlPCj0MPAZq1F711uWiIbs41Lcq+GJE8jnQeP13YaxfbNg4LmpLYhKwDm0rN1XKY1RA5hTsOAWgshjKKgTknf31LF0tPzvzwmnPskjiFJ8BNaqfheoni2UVEulIBmkDe4+QMx/KqCkVrGvXArNYeht5fdEYTNMobL8apW00kOjaZCJiGjBKIbAmHuuDZNkkV7/FX0x3jmbiMLInUzRK5eRFv8WJVjgG9/AuOKCClQ2j/rOHumtXsDvJMnTxlTmJ4P//KS/C6T9qPkZF9KNJSU7J4xJ9QrL/jCmNej6ltVVtQ0g8G9X/SFTaoBI48cWcB2Nx/2RkkAlffVRrpzGWWMV35gPjbrcjtFqB0B6Cy+lYRttomW3Gn3katu5BZmB7aDrpuYRYBGVnLqwc0MkJoaAZgvVDHWUlLyleLgXrHg9rM3KQkIvQq0TGCagXrTKhUSDYXhndz3MUPX6UMJnoFJPFLr997b77cV9qgJDsgbYU9FUMoxMjQxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7511fbbb-00db-4d0e-8ab6-29ae9a18875a", "record_id": "flaws_cloudtrail:0000135:7511fbbb-00db-4d0e-8ab6-29ae9a18875a", "row_index": 135, "timestamp": "2017-02-27T13:07:23Z", "event_type": "ConsoleLogin", "event_source": "signin.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 799, "raw_record_depth": 2, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7511fbbb-00db-4d0e-8ab6-29ae9a18875a", "eventTime": "2017-02-27T13:07:23Z", "eventName": "ConsoleLogin", "eventSource": "signin.amazonaws.com", "eventType": "AwsConsoleSignIn", "sourceIPAddress": "255.253.125.115", "userAgent": "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553"}, "responseElements": {"ConsoleLogin": "Success"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3f7a4a82-6f66-4503-8062-5102f3554dad", "record_id": "flaws_cloudtrail:0000136:3f7a4a82-6f66-4503-8062-5102f3554dad", "row_index": 136, "timestamp": "2017-02-27T13:07:23Z", "event_type": "GetSessionToken", "event_source": "sts.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "signin.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 964, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3f7a4a82-6f66-4503-8062-5102f3554dad", "eventTime": "2017-02-27T13:07:23Z", "eventName": "GetSessionToken", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "signin.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "invokedBy": "signin.amazonaws.com"}, "requestParameters": {"durationSeconds": 43200}, "responseElements": {"credentials": {"accessKeyId": "ASIA6NM0BTLDZR1OT3OP", "expiration": "Feb 28, 2017 1:07:23 AM", "sessionToken": "FQoDYXdzEEYaDMqPmFLqZJ7P0ltJ1SKZAb5L4H5o1M6+sqaVyruAgDvsH+4bkO/6yzVHGqTapN/1hz6UAbPLtgpSb8AfQ6NgRX4ZSsAFADkmRfT9lKmUvg51DJUc6nljMq5BTVjLlgwQFGMZzg/GaOcVtn658hQIXtjd47Q5KxIB6VbDWQtmHmNqqIolKffQBIMOGY/b/a8H66cNmFJ3cn8X4UMOsqWxW5ah0cSEQze+3SiLydDFBQ=="}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dae41825-de10-4ef9-93ee-e3ff2156d6a3", "record_id": "flaws_cloudtrail:0000137:dae41825-de10-4ef9-93ee-e3ff2156d6a3", "row_index": 137, "timestamp": "2017-02-27T13:07:23Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAMY2191PXUZ5JV9NY", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dae41825-de10-4ef9-93ee-e3ff2156d6a3", "eventTime": "2017-02-27T13:07:23Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAMY2191PXUZ5JV9NY", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-27T13:07:23Z"}}}, "requestParameters": {"trailNameList": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0706cb17-8f3d-45f4-80c6-e660fd89f2e0", "record_id": "flaws_cloudtrail:0000138:0706cb17-8f3d-45f4-80c6-e660fd89f2e0", "row_index": 138, "timestamp": "2017-02-27T13:07:23Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "AWS Internal", "user_agent": "[AWSCloudTrail, aws-internal/3]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 634, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0706cb17-8f3d-45f4-80c6-e660fd89f2e0", "eventTime": "2017-02-27T13:07:23Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "AWS Internal", "userAgent": "[AWSCloudTrail, aws-internal/3]", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-27T13:07:23Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "faa8c2c8-694e-417d-a282-38d5682a511a", "record_id": "flaws_cloudtrail:0000139:faa8c2c8-694e-417d-a282-38d5682a511a", "row_index": 139, "timestamp": "2017-02-27T13:07:24Z", "event_type": "LookupEvents", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAMY2191PXUZ5JV9NY", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 706, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "faa8c2c8-694e-417d-a282-38d5682a511a", "eventTime": "2017-02-27T13:07:24Z", "eventName": "LookupEvents", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAMY2191PXUZ5JV9NY", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-27T13:07:23Z"}}}, "requestParameters": {"maxResults": 50}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8529a86e-2468-44ee-bc8e-a6f6341cbeef", "record_id": "flaws_cloudtrail:0000140:8529a86e-2468-44ee-bc8e-a6f6341cbeef", "row_index": 140, "timestamp": "2017-02-27T13:07:24Z", "event_type": "DescribeConfigurationRecorderStatus", "event_source": "config.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAMY2191PXUZ5JV9NY", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "AWSCloudTrail, aws-internal/3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 720, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8529a86e-2468-44ee-bc8e-a6f6341cbeef", "eventTime": "2017-02-27T13:07:24Z", "eventName": "DescribeConfigurationRecorderStatus", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "AWSCloudTrail, aws-internal/3", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAMY2191PXUZ5JV9NY", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-27T13:07:23Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5e4f4ac3-eab0-43f8-8263-a2ba95592b36", "record_id": "flaws_cloudtrail:0000141:5e4f4ac3-eab0-43f8-8263-a2ba95592b36", "row_index": 141, "timestamp": "2017-02-27T13:07:24Z", "event_type": "DescribeConfigurationRecorders", "event_source": "config.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAMY2191PXUZ5JV9NY", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "AWSCloudTrail, aws-internal/3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 715, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5e4f4ac3-eab0-43f8-8263-a2ba95592b36", "eventTime": "2017-02-27T13:07:24Z", "eventName": "DescribeConfigurationRecorders", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "AWSCloudTrail, aws-internal/3", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAMY2191PXUZ5JV9NY", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-27T13:07:23Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "189e761f-d201-47a6-afe3-17dd44d94632", "record_id": "flaws_cloudtrail:0000142:189e761f-d201-47a6-afe3-17dd44d94632", "row_index": 142, "timestamp": "2017-02-27T13:38:24Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "139.123.252.234", "user_agent": "[aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 645, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "189e761f-d201-47a6-afe3-17dd44d94632", "eventTime": "2017-02-27T13:38:24Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "139.123.252.234", "userAgent": "[aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "67c8fa46-d5c6-4015-afde-ddfd1de284be", "record_id": "flaws_cloudtrail:0000143:67c8fa46-d5c6-4015-afde-ddfd1de284be", "row_index": 143, "timestamp": "2017-02-27T13:39:41Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "[aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 651, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "67c8fa46-d5c6-4015-afde-ddfd1de284be", "eventTime": "2017-02-27T13:39:41Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "[aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4fb7e2c3-6e94-46a6-88cd-f602c9971ebf", "record_id": "flaws_cloudtrail:0000144:4fb7e2c3-6e94-46a6-88cd-f602c9971ebf", "row_index": 144, "timestamp": "2017-02-27T13:40:49Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "139.123.252.234", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 771, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4fb7e2c3-6e94-46a6-88cd-f602c9971ebf", "eventTime": "2017-02-27T13:40:49Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "139.123.252.234", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "df492497b-8a1d-4764-897e-2444b39cdaf7", "record_id": "flaws_cloudtrail:0000145:df492497b-8a1d-4764-897e-2444b39cdaf7", "row_index": 145, "timestamp": "2017-02-27T13:41:55Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "139.123.252.234", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 787, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "df492497b-8a1d-4764-897e-2444b39cdaf7", "eventTime": "2017-02-27T13:41:55Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "139.123.252.234", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "08364d6-0080-4c7c-a644-d2a5ceae6e21", "record_id": "flaws_cloudtrail:0000146:08364d6-0080-4c7c-a644-d2a5ceae6e21", "row_index": 146, "timestamp": "2017-02-27T13:52:19Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 775, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "08364d6-0080-4c7c-a644-d2a5ceae6e21", "eventTime": "2017-02-27T13:52:19Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9444fad4-fc0b-44e8-acf8-80191d0f5", "record_id": "flaws_cloudtrail:0000147:9444fad4-fc0b-44e8-acf8-80191d0f5", "row_index": 147, "timestamp": "2017-02-27T13:59:18Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIADELCQ6TDBEO9DS4H", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "10.158.113.0", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1026, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9444fad4-fc0b-44e8-acf8-80191d0f5", "eventTime": "2017-02-27T13:59:18Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "10.158.113.0", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIADELCQ6TDBEO9DS4H", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-02-27T11:25:40Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logGroupName": "/aws/lambda/Level6", "logStreamName": "2017/02/27/[$LATEST]cf803ec1493c94244926adc7f49df1f4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e5e1da00-ab46-44b0-bb53-902931e93460", "record_id": "flaws_cloudtrail:0000148:e5e1da00-ab46-44b0-bb53-902931e93460", "row_index": 148, "timestamp": "2017-02-27T14:05:25Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.254.4.125", "user_agent": "[aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 647, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e5e1da00-ab46-44b0-bb53-902931e93460", "eventTime": "2017-02-27T14:05:25Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.254.4.125", "userAgent": "[aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1f905eb6-aed1-450e-94f3-4e38b9f2f210", "record_id": "flaws_cloudtrail:0000149:1f905eb6-aed1-450e-94f3-4e38b9f2f210", "row_index": 149, "timestamp": "2017-02-27T14:07:35Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1478, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1f905eb6-aed1-450e-94f3-4e38b9f2f210", "eventTime": "2017-02-27T14:07:35Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAMDIQ8FK64LUQLV3T", "expiration": "Feb 27, 2017 8:41:12 PM", "sessionToken": "FQoDYXdzEEcaDJqEE58bFAGK7urIrSK3A3a0ZwR9mNUZrZJhe39fEGk0wb5737I9gbuUiltyS+ZhEDqv4QYQz+oKMHxei6Xuwa68IWoAevd1ZUsl7RTZs+Q9BN1KVKhehFy9ui7T43vSHa73p7a5o4KDTzJWe8KX26j3PCRtTJKLgAUceY5pROoAK4HlRDzcZmhjK8bPo21QOzcXzrB8FT3jwGqx2KHOaDT1kIpt0alslLx/Yc2VUxSNQPn1V/YWE9K+/bMpLY2I8TIBpq2BsOaJD99oIeNHNuEadcK80SOR6Of5Q2l8TMvK8iBOytb/7Q6apqNgtaKnZsYdoz60c79pBmE5+bv7irwsJJA2ZpE6WrG0unyzZBY4zVX6swUD2vq3II8CO4eIzZ7e3BhvQjqJbBfFS1xTtvtCtwNWsotA91l7JP/5TaHs2TtoEen3+2pkOD9OBn3MSdbe1jtjh8rPaxRb3ZR6jafkJPAJJtcaD8WXS8zd+zZX+gmlGFdxHmsN3nUAnNfw/nXBKWkMkxsWVb2RYKw2wH+VTyw4BUNwMoPNGPYzCpZCBBxcKa0sdoNwrSHN+I6mmJAaODGeBZJAlXw+MWAOxRiHpINDT84op+XQxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3e32efdf-3363-4271-808e-e84d5f8d6400", "record_id": "flaws_cloudtrail:0000150:3e32efdf-3363-4271-808e-e84d5f8d6400", "row_index": 150, "timestamp": "2017-02-27T14:07:54Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.254.4.125", "user_agent": "[aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 649, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3e32efdf-3363-4271-808e-e84d5f8d6400", "eventTime": "2017-02-27T14:07:54Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.254.4.125", "userAgent": "[aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f25bcea9-e0b8-42d6-a805-785688d6bd857", "record_id": "flaws_cloudtrail:0000151:f25bcea9-e0b8-42d6-a805-785688d6bd857", "row_index": 151, "timestamp": "2017-02-27T14:10:02Z", "event_type": "DescribeInstanceStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.254.4.125", "user_agent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 737, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f25bcea9-e0b8-42d6-a805-785688d6bd857", "eventTime": "2017-02-27T14:10:02Z", "eventName": "DescribeInstanceStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.254.4.125", "userAgent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}, "includeAllInstances": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8605a5ff-6c1b-4b8a-b77e-d7f1d89fe261", "record_id": "flaws_cloudtrail:0000152:8605a5ff-6c1b-4b8a-b77e-d7f1d89fe261", "row_index": 152, "timestamp": "2017-02-27T14:10:45Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.254.4.125", "user_agent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8605a5ff-6c1b-4b8a-b77e-d7f1d89fe261", "eventTime": "2017-02-27T14:10:45Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.254.4.125", "userAgent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "379590a-72a6-4d18-b0fc-61afaeb64eb8", "record_id": "flaws_cloudtrail:0000153:379590a-72a6-4d18-b0fc-61afaeb64eb8", "row_index": 153, "timestamp": "2017-02-27T14:10:49Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.254.4.125", "user_agent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "379590a-72a6-4d18-b0fc-61afaeb64eb8", "eventTime": "2017-02-27T14:10:49Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.254.4.125", "userAgent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJQUW0xaUZRWGNKVWhpakhRd3pCYm9ZWXhtSzJscmhXNzlYMmdTUnREU2hTOVVDRUgzVlF1WmsycU1sSUR0WUpiaDdNSHU3RnVFQzE0RFUxTHNEbkRmUWpDc0xJbjRlcFJJdG96b3ZhR0k0amRLOXdiWHYwKy95SUVqeU5aM0hpaGlraU1PZWVEUDBsOUUxSWsvaHBBOEE9PSIsImkiOiJidjlPMllpUUtmU0MwWmw1VHVMZUpRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6d67c55a-c546-4634-bef5-f80f3914fada", "record_id": "flaws_cloudtrail:0000154:6d67c55a-c546-4634-bef5-f80f3914fada", "row_index": 154, "timestamp": "2017-02-27T14:10:52Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.254.4.125", "user_agent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6d67c55a-c546-4634-bef5-f80f3914fada", "eventTime": "2017-02-27T14:10:52Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.254.4.125", "userAgent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJvTEM0Mkg0MHl4MFlFU1lQZENhcS9Kc3NrT3hSWlAweEdQL1dWTFdPcG9vSjJhTmdBT2MxS01zbXJLNVV2a1RlSmhYN1dNU2d2NEhVQ0Y1aDlmbzM0a2xsdnJZQ2cybG03MXA1S1dWTnh6UnJVa3lUNyt4NGdBMjRFNHRBRVZDOWFCUklLMi9OaFZVODFnQlRQcnFvOEE9PSIsImkiOiJvU0hsZUlDUHZVb09OeU1yUnRlSEdBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4ec98d68-f9e5-4b48-befe-f8e3c52be8ec", "record_id": "flaws_cloudtrail:0000155:4ec98d68-f9e5-4b48-befe-f8e3c52be8ec", "row_index": 155, "timestamp": "2017-02-27T14:10:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.254.4.125", "user_agent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4ec98d68-f9e5-4b48-befe-f8e3c52be8ec", "eventTime": "2017-02-27T14:10:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.254.4.125", "userAgent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJwSitmQ0d1c2crZ0dQMENNd1JZbFcyZUU0S1BwWDRoaGk1RkVrVGFaVWJackhWZFcvNWg1VEhKRTJqbGR2a3F1N0E1NDRlQXlab3dMMmpBZGVEa1VLNlBvaHFCZlFtVXlJZXJqUHllV2FIZEdVSDdobStRM0NuVXVsaFBwTmVPNEtrbVFwUms2N29xdDV6UThSRkwzWUE9PSIsImkiOiJwb0kzeDNINmk4dXNTeXloemdyY0xnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "19652b1-c99a-4e93-b50c-c2c68bc2ff2b", "record_id": "flaws_cloudtrail:0000156:19652b1-c99a-4e93-b50c-c2c68bc2ff2b", "row_index": 156, "timestamp": "2017-02-27T14:10:59Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.254.4.125", "user_agent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1043, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "19652b1-c99a-4e93-b50c-c2c68bc2ff2b", "eventTime": "2017-02-27T14:10:59Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.254.4.125", "userAgent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJWLzZkUGVzaWpKVXJUdzVsSElzaWV3NWhkNVY0Z0VjaGdsMFI3SjVaOU5WRDlkNk9qRTNueGNQbDhKUzFWL2szZitZUU1LUFlSR1BIcmRUdjF6c1dXcEFhemd4d01PdDZDQjdHSEJlWUpHa2VCQXpIOGpxeVF1amJERGErL0liSDhtU1FUTzVQTm90MmhxV21lNjlZTHc9PSIsImkiOiJCTVFCaFNvZVZBUmorUm9LRElBNm13PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "25e79e6a-8bc9-44bc-9f93-4f1fb30292f", "record_id": "flaws_cloudtrail:0000157:25e79e6a-8bc9-44bc-9f93-4f1fb30292f", "row_index": 157, "timestamp": "2017-02-27T14:11:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.254.4.125", "user_agent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "25e79e6a-8bc9-44bc-9f93-4f1fb30292f", "eventTime": "2017-02-27T14:11:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.254.4.125", "userAgent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJ2OHo4K1dic2c2MWhRcktVcG9DdWt4cW5mR1R3ZWJNSjZ3YkNqY3Vhb05RUGpzbitSWHlqemlGdlNFZFBkZXlXWUN5UmJnZVIzUVo0aFl1dy9yT2hpeTJJdWdUV01xTFNlWisrTXRHY05UOGpaYWZPaHpkWjl5azdvRFUyb05BUUVEWXVEK2RpWURTWGk0ZDJ5M1FLOXc9PSIsImkiOiJSVm5sbkpvemFLVVg1NzEwSS9uSEhnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0a6a4cde-2f04-44f4-a294-11ddf527209", "record_id": "flaws_cloudtrail:0000158:0a6a4cde-2f04-44f4-a294-11ddf527209", "row_index": 158, "timestamp": "2017-02-27T14:11:07Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.254.4.125", "user_agent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0a6a4cde-2f04-44f4-a294-11ddf527209", "eventTime": "2017-02-27T14:11:07Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.254.4.125", "userAgent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJFMTdhTnlNaHJTbHB3TWhmMjR1eGw3OEdITWNQSjRmTGo3WUoxbGRBYlNKb0JVVlI4Y0tYdmVGYXV1amtSVm8yVVJBY1d6cEhncnYrYVJVdFB5NWV5S0VXbm1Vc3owNUFzS3NFRCtxSDcvRlpVUWhBK3ZRdWt3bnNXM3RQaHBQQnlQSE5qTHNUdFRrdnFFK2hFQUU5UXc9PSIsImkiOiJCS0xKU3lUeXlGbTY4MTJhM0l3ZUlnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cb48ffcb-ffc4-422c-9b1c-ebd5c3972f0d", "record_id": "flaws_cloudtrail:0000159:cb48ffcb-ffc4-422c-9b1c-ebd5c3972f0d", "row_index": 159, "timestamp": "2017-02-27T14:11:09Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.254.4.125", "user_agent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cb48ffcb-ffc4-422c-9b1c-ebd5c3972f0d", "eventTime": "2017-02-27T14:11:09Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.254.4.125", "userAgent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJnM0lLZnpwaDZIRmIxR21hck1DbU1NelpoekZ3RkMrSjdVY1NibHpVSmVnVmlSeWpLRk80VDJ2QndsNUVqUWxZenEvM2NNOS9pSjJ4UnB5VjZrZUZnZFVVdkI0dy9sUFdPZjhZelJLMWxRaGJFRFVxTWpWQTI3NGlrb255a0xVcGxrUElobTIyODlqaGdNZFNWVHdPTlE9PSIsImkiOiIycDFCWEpISU1hUHl3RDRSNVZIdThRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "af46f75c-81a6-42f5-8635-e735b4a4075d", "record_id": "flaws_cloudtrail:0000160:af46f75c-81a6-42f5-8635-e735b4a4075d", "row_index": 160, "timestamp": "2017-02-27T14:12:42Z", "event_type": "DescribeInstanceStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.254.4.125", "user_agent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 737, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "af46f75c-81a6-42f5-8635-e735b4a4075d", "eventTime": "2017-02-27T14:12:42Z", "eventName": "DescribeInstanceStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.254.4.125", "userAgent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}, "includeAllInstances": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "00e40eb2-2427-4b61-a49f-09045a9e9b00", "record_id": "flaws_cloudtrail:0000161:00e40eb2-2427-4b61-a49f-09045a9e9b00", "row_index": 161, "timestamp": "2017-02-27T14:13:42Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.254.4.125", "user_agent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 775, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "00e40eb2-2427-4b61-a49f-09045a9e9b00", "eventTime": "2017-02-27T14:13:42Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.254.4.125", "userAgent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "16bc2033-28a1-427a-bfc2-bd8084bbf8b1", "record_id": "flaws_cloudtrail:0000162:16bc2033-28a1-427a-bfc2-bd8084bbf8b1", "row_index": 162, "timestamp": "2017-02-27T14:14:00Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.254.4.125", "user_agent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 790, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "16bc2033-28a1-427a-bfc2-bd8084bbf8b1", "eventTime": "2017-02-27T14:14:00Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.254.4.125", "userAgent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3abf5f9b-77b0-4738-8c66-b8e2c8ed1f71", "record_id": "flaws_cloudtrail:0000163:3abf5f9b-77b0-4738-8c66-b8e2c8ed1f71", "row_index": 163, "timestamp": "2017-02-27T14:20:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.254.4.125", "user_agent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 790, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3abf5f9b-77b0-4738-8c66-b8e2c8ed1f71", "eventTime": "2017-02-27T14:20:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.254.4.125", "userAgent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b0b93606-0358-40f2-a3b2-50598c2286", "record_id": "flaws_cloudtrail:0000164:b0b93606-0358-40f2-a3b2-50598c2286", "row_index": 164, "timestamp": "2017-02-27T14:22:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.254.4.125", "user_agent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 788, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b0b93606-0358-40f2-a3b2-50598c2286", "eventTime": "2017-02-27T14:22:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.254.4.125", "userAgent": "aws-cli/1.11.54 Python/3.5.3rc1 Linux/4.8.0-2-amd64 botocore/1.5.17", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a26e2bff-1d51-4639-982a-2f70b234231f", "record_id": "flaws_cloudtrail:0000165:a26e2bff-1d51-4639-982a-2f70b234231f", "row_index": 165, "timestamp": "2017-02-27T14:23:43Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 777, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a26e2bff-1d51-4639-982a-2f70b234231f", "eventTime": "2017-02-27T14:23:43Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "695dda69-42a7-4b62-9034-1476b284eddd", "record_id": "flaws_cloudtrail:0000166:695dda69-42a7-4b62-9034-1476b284eddd", "row_index": 166, "timestamp": "2017-02-27T14:25:39Z", "event_type": "GetBucketLocation", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "[aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 737, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "695dda69-42a7-4b62-9034-1476b284eddd", "eventTime": "2017-02-27T14:25:39Z", "eventName": "GetBucketLocation", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "[aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"bucketName": "level4-974134b52e7c35aebcc4b45f19113936.flaws.cloud", "location": [""]}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "35619adf-34f1-4888-9f50-20862c17ec", "record_id": "flaws_cloudtrail:0000167:35619adf-34f1-4888-9f50-20862c17ec", "row_index": 167, "timestamp": "2017-02-27T14:25:57Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 790, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "35619adf-34f1-4888-9f50-20862c17ec", "eventTime": "2017-02-27T14:25:57Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "df6ce308-2aa4-46f3-89fe-c55654e84e0d", "record_id": "flaws_cloudtrail:0000168:df6ce308-2aa4-46f3-89fe-c55654e84e0d", "row_index": 168, "timestamp": "2017-02-27T14:26:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 758, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "df6ce308-2aa4-46f3-89fe-c55654e84e0d", "eventTime": "2017-02-27T14:26:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8e92ca70-1e9b-4989-ad1f-ef66026b3a2e", "record_id": "flaws_cloudtrail:0000169:8e92ca70-1e9b-4989-ad1f-ef66026b3a2e", "row_index": 169, "timestamp": "2017-02-27T14:26:18Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8e92ca70-1e9b-4989-ad1f-ef66026b3a2e", "eventTime": "2017-02-27T14:26:18Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiI5UVlhSktOMGdiSC9JeTlhQzRqUW5UV2VVL1pSckgzeUY1MUI0Y3FRK05FcU50VG95SHh4dEpKMFdtbU1uT1lyOVlMckh0Y0lHNEhyNE9laEZCRG90QW9waGs4dXozaExRK2Fybk41NHZWMmRIbHU4ODkwUzdZenJMbVQwbTU2RDNvVUZGTGowZWpIQnlGeVRwbENlRnc9PSIsImkiOiJBRFY3VFNSS25PTXh6NE5GbXRRQyt3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8e580418a-e398-4df2-96a2-f452460fb27a8", "record_id": "flaws_cloudtrail:0000170:8e580418a-e398-4df2-96a2-f452460fb27a8", "row_index": 170, "timestamp": "2017-02-27T14:26:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8e580418a-e398-4df2-96a2-f452460fb27a8", "eventTime": "2017-02-27T14:26:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJvQnZBbTUvSjI0azBDWXd4Umtlc3BFeUsrcmhyNnVKUXBEVVUvS2R0M0grQldRTmVhRnZ4UnJtWDFSSWIxWUNxZ0tnbjg4VnY4Vjc4YXY2NTl5aWZqNkU1QjVrK1paNnZNQXppUHEvVXVuendNczdya1ZHQlJWYW5vUTMvUnFKeTVCV1VuaHdpRlhuUC8veXBUM1hMUnc9PSIsImkiOiJWRVZ3YTBjaVVYS1JsTTJIU1FjWGN3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a0e32c59-fc94-465f-85e0-7f62e3469b45", "record_id": "flaws_cloudtrail:0000171:a0e32c59-fc94-465f-85e0-7f62e3469b45", "row_index": 171, "timestamp": "2017-02-27T14:26:27Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a0e32c59-fc94-465f-85e0-7f62e3469b45", "eventTime": "2017-02-27T14:26:27Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJMa2RmMTM0bzFLUEMxSkhyQ1RzV2d2UEVjNlVsVkpmc0NhaTU4c2tUc2NEWEhQS2J4eHdGS3lmMnlvMVRMU09EWE9SNWVtS1pVNHhjQklNdXQxcjA1TGpIajU2b25jdUdzY0ptNUJzUllUeDBZbGpnT2tRbmRKaWp6aGwvbjY1RVhDV2dtTEwrb1F0V0RnS01JMElyZnc9PSIsImkiOiJOdE05WE9GQXFYRFNoTTYrMzlKdWl3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a83654f5-8594-427d-9e5a-1d1fd2dceaa3", "record_id": "flaws_cloudtrail:0000172:a83654f5-8594-427d-9e5a-1d1fd2dceaa3", "row_index": 172, "timestamp": "2017-02-27T14:26:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a83654f5-8594-427d-9e5a-1d1fd2dceaa3", "eventTime": "2017-02-27T14:26:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiI2YlZRUGpBbXJHbEoxek0zM0IxazNYa1dqekJGek5NV084M3pSVlRWaGltcURYSk9HRVFaeCtENU51aXhudmY3U3RadGE5RWtBaEhoZGtFV1VqWlUwYzJOc2x2THBBMGVwM2dkQWNJRjhPd29pRXZBbTZoRnU4aDFZelV5YlROaUNyejJyOGgwL0ZySHlFVzB6N3BxSEE9PSIsImkiOiJpbkZnQUc2U2J6TTlGWWxobDdxTCtnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b940beb8-adbc-447d-a456-88b02fc7e7f8", "record_id": "flaws_cloudtrail:0000173:b940beb8-adbc-447d-a456-88b02fc7e7f8", "row_index": 173, "timestamp": "2017-02-27T14:26:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b940beb8-adbc-447d-a456-88b02fc7e7f8", "eventTime": "2017-02-27T14:26:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJYcHJDV3o0YndrUy8vTHJlYnE4dDhoVTU1NCtHREVPdU9FWXNwR0Y0YjYyeE5JRGJxK1J4a1hZbU5KYzRlckV4MktDcWNZNkU3NjBhcUQvaXoxOUh6WFVsWGJreE5hN3A2d1l2a1p2QnJuUkxFbXNvR1BRLzdMdEx5ZEpCVUtPREdHTjRvWjZOUlpxTTdNQmNPRU9GdEE9PSIsImkiOiJiQlRaY3FUWXpEZjEwOFhIQXQ3MTRBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0a123da3-062c-47af-9c2c-8a2041edcb07", "record_id": "flaws_cloudtrail:0000174:0a123da3-062c-47af-9c2c-8a2041edcb07", "row_index": 174, "timestamp": "2017-02-27T14:26:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0a123da3-062c-47af-9c2c-8a2041edcb07", "eventTime": "2017-02-27T14:26:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJyVXgvemtnWlVqVXFmaVkwcHZRWlhkZXBNNVhPNUhwb1dxUmZzcWVLdWs3dStzR1BjTmpwR0pUUzNIQlJCL09xTzJJZXowZk16eTVXSmN6SGRkcFVJUTNMb2VoMlYra0hlVW9saWw3Z0RtZjNSM3V6cHZNdklJVGZ3VmxNcVhtSGE5YVNjRGd2dER0UEhwbUFSR0VTc0E9PSIsImkiOiI0Qi9iMTg0VUd4Z2EzSmgwNDVoNmRBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "195dd6e0-ac3c-4a05-8bec-006cf502338d", "record_id": "flaws_cloudtrail:0000175:195dd6e0-ac3c-4a05-8bec-006cf502338d", "row_index": 175, "timestamp": "2017-02-27T14:26:45Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "195dd6e0-ac3c-4a05-8bec-006cf502338d", "eventTime": "2017-02-27T14:26:45Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiIyVEltWXlyM05PQ3VWbHUzL0FiQkNDTnhEajNzWnBoWUdUZkVSNmdaUGorUFM0V0tud2RLVGZ4RjRkcno5WUNCUlkzRWpKL0F1VjNpaDJoMWR5bWltTzl1R01idVJTRm5uNmRsQWZzWFZ1eW55U09EQkxWL2lsdVZ3MERESXBIZ1hXeE1pSjJ2dUl6ajlEVWtXczVLd2c9PSIsImkiOiJyZWRyeHhFMjBqOVhiNG5DRnZMTzV3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a963f1bb-8e21-405d-841f-bdbc88659947", "record_id": "flaws_cloudtrail:0000176:a963f1bb-8e21-405d-841f-bdbc88659947", "row_index": 176, "timestamp": "2017-02-27T14:26:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 758, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a963f1bb-8e21-405d-841f-bdbc88659947", "eventTime": "2017-02-27T14:26:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d89a163f-b048-4454-ba0d-647aa2de410c", "record_id": "flaws_cloudtrail:0000177:d89a163f-b048-4454-ba0d-647aa2de410c", "row_index": 177, "timestamp": "2017-02-27T14:27:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d89a163f-b048-4454-ba0d-647aa2de410c", "eventTime": "2017-02-27T14:27:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiIwZW1rZUdobXc3dWVzNlN6MHJKZy81N0VGenllL1I4MWVxVWpPTW9kRFV2ZDdRRFBOcHVmanAzd21ReHlVY3d4L2VWU3ptRytCbmpSWEZMYjZBRjRSUTZGemRSRVFCU3BmU09oN2VyK0xHeHJFcGk4cVZmUlM4VnJ0UjlMRVhudzZkMm12OTZYZFBRbFBQa3JvMVRNakE9PSIsImkiOiJRZmdkYnNHbzB4Z0ZhOFRPVDJKLy9RPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "02fcd5ef-69e9-4a67-90e2-bba0c3fac9ef", "record_id": "flaws_cloudtrail:0000178:02fcd5ef-69e9-4a67-90e2-bba0c3fac9ef", "row_index": 178, "timestamp": "2017-02-27T14:27:07Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "02fcd5ef-69e9-4a67-90e2-bba0c3fac9ef", "eventTime": "2017-02-27T14:27:07Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiI4ajFSbFJaalVrUkV4cmZDeDRnVTVYTkVEczlqck1uNWZmSUJFZ1ZLYzlNR0FrSGxqMUZMc1A5UVc1MndWVEhsVE1zL2xOVmViU2Z0NHlvWnpPSElrWFAyWWVLUTd0QjdvR01jSlZWRzAzSTRoZmF1OWtrL2tQL3M1TnRZUWF0QW8zakU3aTFNNERuV2FPMnQ2bjlYTHc9PSIsImkiOiJDckxpaSt2cHZCZXZ3VUpBZDREYWpBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "994024-f492-4cf9-a79d-7c878d3b5ff3", "record_id": "flaws_cloudtrail:0000179:994024-f492-4cf9-a79d-7c878d3b5ff3", "row_index": 179, "timestamp": "2017-02-27T14:27:10Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "994024-f492-4cf9-a79d-7c878d3b5ff3", "eventTime": "2017-02-27T14:27:10Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJxUGRkOEtHNHMwRVhYVWkrbDN4S0x6RStIQmxOVHYybGl2K2p4RFZYUkhSV2JlUnVhOVpNRjc5V0RzWnUvSE9PQVRzcUE1a2E3K2xNT0hEQzdJSGtteHQ1UVp5UWJwOHY0MDkwTXp5SnV2Z2VlWFJrZERUYW02bmFZaEo2cG5NVEh4OTQrbEpaSjN3OGh3N0Nxd1k0MlE9PSIsImkiOiJCSjhvd3RlRXlLSm92UkJvLzY5R3hnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e64b291b-956b-4e0c-9561-7be709057", "record_id": "flaws_cloudtrail:0000180:e64b291b-956b-4e0c-9561-7be709057", "row_index": 180, "timestamp": "2017-02-27T14:27:12Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e64b291b-956b-4e0c-9561-7be709057", "eventTime": "2017-02-27T14:27:12Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJvb0djZHBSMCtJZVNPb1Mzc1ZienlyY2hwMUhwM3FZWHhUVGtac3hTdEIvaHJmK3ZkUk1xSk1JU1hRazNuaC9wSzJHQTMraTgvRi85S0krYk9EclFCZ1NiTnZtSks0M3g4TUUzRUVBeUlrMkVieEgxbUxJMEh5M3Z5dy95d0pjVXhxTVBReTlJOVhrMjVMUlp3RlNCYlE9PSIsImkiOiJFcm9jTDQxSjRjTVQzMkxBU0JiVW5BPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a9a247ab-6e1f-4f32-bf0e-1e000e8b6a58", "record_id": "flaws_cloudtrail:0000181:a9a247ab-6e1f-4f32-bf0e-1e000e8b6a58", "row_index": 181, "timestamp": "2017-02-27T14:27:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a9a247ab-6e1f-4f32-bf0e-1e000e8b6a58", "eventTime": "2017-02-27T14:27:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiIrNklQY3cxeGFQQnhZY1lkNDM3c2RWSXRsM3ZlQUZEUU1DSmFka2FiSWdDNnNIV1ZCVFBQdGJ0ejFsZTA5ZlpuVjFkUWhZazcwVHlHQWJEbW00ayt0dEFRdE1HUkNKU0VwRUpCVkxZNEVGUk45RGxnRUJoVjVsU3ViWGJoMUgxQ1ovNmtsNFV0eDByQzQyRmkxZzkrRkE9PSIsImkiOiJDc2JxVUIvQWhQUlpYOFFIblIvWjR3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1fd64a7a-f2f0-4a98-8265-4ed6eb7e147b", "record_id": "flaws_cloudtrail:0000182:1fd64a7a-f2f0-4a98-8265-4ed6eb7e147b", "row_index": 182, "timestamp": "2017-02-27T14:27:15Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1048, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1fd64a7a-f2f0-4a98-8265-4ed6eb7e147b", "eventTime": "2017-02-27T14:27:15Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiIrSWNqTWdmbWptcGNscTIxU0pESWtTRlUxS2s2UzJ6Mk9tT29uQnlHVjZ1aVZHUG5BUXN0VTVkSlNNaXVHRi9WbnRQcEdnZ2kyRkZoMWczTDRWUDU1dTh0TE4yM1B0dXZnU21IOVBTbWVLb21xSHcxTzg5MUJEa3dQZ05MZUR0eDdNdHF1cjFtUTBNQmFib1kyQWxmWEE9PSIsImkiOiIwTlJLM3hvZHRnZXluNlg4Ujd4U3dBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e8415d6f-4fe6-4308-8656-73d99c7e87d6", "record_id": "flaws_cloudtrail:0000183:e8415d6f-4fe6-4308-8656-73d99c7e87d6", "row_index": 183, "timestamp": "2017-02-27T14:27:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1048, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e8415d6f-4fe6-4308-8656-73d99c7e87d6", "eventTime": "2017-02-27T14:27:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiIrM0VkaDFwQ3poM3IzUHBRYkRqS2tOdWJnM2tHWG5ENjh5WWowOVJVWnpvZUdkWmIzM1FsVHdXck11UWR0NEovYlhVcHlYa3Zqc215Vmx4Y2RqNS9YSk4rQ1plampUQ1dTZlZKdW13aUViYWY3T1BocEp6ZCtiLzhLZExlenllRGliNEo2aGRKZUYxUElNT1FVL3FMY1E9PSIsImkiOiJlMEpxTmRNNVNYaHgrNUNBa2NQK3FBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "339510cf-118a-42d2-92dc-638d78086c92", "record_id": "flaws_cloudtrail:0000184:339510cf-118a-42d2-92dc-638d78086c92", "row_index": 184, "timestamp": "2017-02-27T14:27:27Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 758, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "339510cf-118a-42d2-92dc-638d78086c92", "eventTime": "2017-02-27T14:27:27Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "82c10b2d-ae38-494a-8ea8-ccb32d5cd399", "record_id": "flaws_cloudtrail:0000185:82c10b2d-ae38-494a-8ea8-ccb32d5cd399", "row_index": 185, "timestamp": "2017-02-27T14:27:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "82c10b2d-ae38-494a-8ea8-ccb32d5cd399", "eventTime": "2017-02-27T14:27:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJHYmpBSngvcUU0M2V1NUYrTzBva3Q3TmljeWtheVRZc2ZFL2FwWEJxd3BiMTNQb3k1YTlueStSckRJaXVpUWZOMVhTNkp2ZTc3ZnNwdUVMRlB6ZzFoTTc2WkUwZlp0cDdHa1dyRXl4ZGJ2aDMxb2k0WHhwMXc4dExPVDFPRkl3dHBHWnZ0M25HeHFydXhEdU55V1BBWXc9PSIsImkiOiJOWG5maysvNDRNSFMxTnlVNGIzd0NBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ca9e2623-8a47-4e12-bcd3-89f85393ef07", "record_id": "flaws_cloudtrail:0000186:ca9e2623-8a47-4e12-bcd3-89f85393ef07", "row_index": 186, "timestamp": "2017-02-27T14:27:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ca9e2623-8a47-4e12-bcd3-89f85393ef07", "eventTime": "2017-02-27T14:27:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiIzdVlpZmhLaEdFdkNBM3dFUFdiaVpMclprZnh1S2NZMTBZNTRFMVF2NmpiNTYvR2VTSVplZ2l0TFM5YUs2dFE4T1FjZHJwc0dIcDZXamhzOERPWjR1OVd0UkhOekF5dnNoQmJxZHhmZ1FhdjRyZzlnc2w5aFA2bms5T2xKai9MSW9seGdMSXJGSGVWc3JvZkQ4V2hpUVE9PSIsImkiOiJTZ0x3cWpseFVSbm9GRWwrVUxFWi93PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "344f5f40-0468-4d23-a1cf-3014f9038742", "record_id": "flaws_cloudtrail:0000187:344f5f40-0468-4d23-a1cf-3014f9038742", "row_index": 187, "timestamp": "2017-02-27T14:27:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "344f5f40-0468-4d23-a1cf-3014f9038742", "eventTime": "2017-02-27T14:27:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJLRmtzN3dxMmpCOGFMUElveVNqblhDNmZwZVV3bmpMUHAyZGlFNXhCZFRpbVI1Ui85YkFXODJ5bDRqWXcyanliRmFQZlJHTmlEUVQ0MGVrNEJKR3hIdlc3YWVzUHBIK0IxZFMxWUlTUXozLzNWMUk0U1Qyd1BRQlBkNWRMMGhUSTNLdTN5UlVVdEx0SUUyL25hbjMxV2c9PSIsImkiOiJRRDQvQ2c0NGRpOHlzQlFCYmkxS1RRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5b335b99-387b-4401-a7d2-5f659ce273895", "record_id": "flaws_cloudtrail:0000188:5b335b99-387b-4401-a7d2-5f659ce273895", "row_index": 188, "timestamp": "2017-02-27T14:27:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5b335b99-387b-4401-a7d2-5f659ce273895", "eventTime": "2017-02-27T14:27:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJZV1VqOC9CZHNOc1NKd0ZIYVZYL1JWaElMMGphNWVIMERZa1kzY1BEY3Q1UksrYjFWTWxzSGNsTk1oUFJGajdKN0J0M2FEYnVFMmxYZnNBNFlHM3AvV05iS09sK2JLVDdzMFJrNkZKSlhVei8rN3BlVjlFYjN3bDkyZko5WkhwN2VCcndYQWNOVVgwR0cxb1hDcGtZL3c9PSIsImkiOiJiS2c4TFkyL1VldEM3c0tKb1hMTFlBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9d6b6537-9148-4eb6-9c82-7d8a9711ff3e", "record_id": "flaws_cloudtrail:0000189:9d6b6537-9148-4eb6-9c82-7d8a9711ff3e", "row_index": 189, "timestamp": "2017-02-27T14:27:46Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9d6b6537-9148-4eb6-9c82-7d8a9711ff3e", "eventTime": "2017-02-27T14:27:46Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiI0aHVocUtIMDRFYlBpYUE1cU5aalNzVmFETVZpdlVETVBVMkhvM0xWcDEwKzhTVks2bHlxU3hacUZ3RzJqekgzanBOK2VRVVJvL0MzTGNpRjV3WUxNTUtxZ1FzWHJmK3FKUEdHQ0IzTmJINGQ4R3JYbWxsT00wV1ZXNnpsb05Razh2Wi9rR1JlSUFIbkZWRnJ0ZWtCY1E9PSIsImkiOiI2aWVGeFRydWpuMEtQY05FOHo2Y0VRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5c381333-559f-4424-b8a7-8cf95d3b6e2d", "record_id": "flaws_cloudtrail:0000190:5c381333-559f-4424-b8a7-8cf95d3b6e2d", "row_index": 190, "timestamp": "2017-02-27T14:27:49Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "83.19.40.164", "user_agent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5c381333-559f-4424-b8a7-8cf95d3b6e2d", "eventTime": "2017-02-27T14:27:49Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "83.19.40.164", "userAgent": "aws-cli/1.11.8 Python/2.7.13 Linux/4.8.0-kali2-amd64 botocore/1.4.65", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJCbXQzdVJwUGhPZnVMby9VQXkxM1NLSzFnQ2FtOUlnb0o1NlExV1lmL3BYSXVVaVNPcUo1dS82VXpxUFNvdW1rcW1uNGI0WHVHTFd4ekIrY1lVVlQ4SEF6dmxxQXdLTU9HY3ZhbmVHUTJjWFJrdVFScmpxclBmTG1nSHp3TVQyWlhJaDNxTUhvdzBMU0EzcVlSTk9RZVE9PSIsImkiOiJwT255UDBKRDVoQS9qdjdLWXZQU3pRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "17104e5-d7e6-4796-ae4e-d1596aded147", "record_id": "flaws_cloudtrail:0000191:17104e5-d7e6-4796-ae4e-d1596aded147", "row_index": 191, "timestamp": "2017-02-27T15:05:13Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "90.1.71.230", "user_agent": "[aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 639, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "17104e5-d7e6-4796-ae4e-d1596aded147", "eventTime": "2017-02-27T15:05:13Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "90.1.71.230", "userAgent": "[aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "223512ef-2607-45a1-97f0-0f97dda5282e", "record_id": "flaws_cloudtrail:0000192:223512ef-2607-45a1-97f0-0f97dda5282e", "row_index": 192, "timestamp": "2017-02-27T15:07:40Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1475, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "223512ef-2607-45a1-97f0-0f97dda5282e", "eventTime": "2017-02-27T15:07:40Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAT3YPF0RKQ5L5T81F", "expiration": "Feb 27, 2017 9:17:23 PM", "sessionToken": "FQoDYXdzEEgaDMlB9lTvpJbWjVLwcSK3AwnGxbSwXlLbjCfNxXo1TLk04Bp9j8NYNy3H6lqQQyPkCi//kpS2mlc3+M6LxlZfyXTlsTn9UnoBqk7nAhOdP8W3dBMrShJFSDp9l4l/kTPAzgWEQ5ZPrzkrVhYe6Z6hJGKQU2VEp9zAmT0MdHMeXz+Gztc9VPOPLC94HEj8DiesUfD2E381eQnd3qjgMSV2W7Y/9i6fg2BXijjRMpeyZ9mqmuT2pfyurIwNPlqtN2m+xkrRi6xxw9C4mcYo8SAFImXBmTsz4QPI5BzBJAV/DMkVfYqIieYpbTpgXeP8PifHoE7C3t1EVkDM8ZaTlrxk+gwTJ6jg3Q0C8dpET/hK+XtvDJiJYuOip+WQ5OVRFl1tbY4VDxRJtSsahBpE8lgW2b4HXhJratVwn+1P5OyA+xDJy5QoBpmc0LfuUH7UO/NYlC0Sn4zT2B1+1S53+tLEkD+4/Pmq8KaNfjkOBQBxhPXWP25lBeOb37cYF/hxmP4lJAxliMBijKS7o/gpAC6wjPNZgqB24gjvyoJdXRVA4ONhcF5/Nh1qGPdU9UaTqZhjwDP7M0CCtON/w/T4AI9dMfTKSBJrHtEovIHRxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c8c7c0aa-0c08-442e-8071-a06911adb0ed", "record_id": "flaws_cloudtrail:0000193:c8c7c0aa-0c08-442e-8071-a06911adb0ed", "row_index": 193, "timestamp": "2017-02-27T15:08:56Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "90.1.71.230", "user_agent": "aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 765, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c8c7c0aa-0c08-442e-8071-a06911adb0ed", "eventTime": "2017-02-27T15:08:56Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "90.1.71.230", "userAgent": "aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1a64950-704f-4926-9fcb-2561e3e861f7", "record_id": "flaws_cloudtrail:0000194:1a64950-704f-4926-9fcb-2561e3e861f7", "row_index": 194, "timestamp": "2017-02-27T15:10:46Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "90.1.71.230", "user_agent": "aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1a64950-704f-4926-9fcb-2561e3e861f7", "eventTime": "2017-02-27T15:10:46Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "90.1.71.230", "userAgent": "aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4859d832-058b-4c85-bfb1-6606fe727df7", "record_id": "flaws_cloudtrail:0000195:4859d832-058b-4c85-bfb1-6606fe727df7", "row_index": 195, "timestamp": "2017-02-27T15:11:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "90.1.71.230", "user_agent": "aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4859d832-058b-4c85-bfb1-6606fe727df7", "eventTime": "2017-02-27T15:11:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "90.1.71.230", "userAgent": "aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5653fb6e-6f9c-4ea7-aca6-04f2ecf09f1b", "record_id": "flaws_cloudtrail:0000196:5653fb6e-6f9c-4ea7-aca6-04f2ecf09f1b", "row_index": 196, "timestamp": "2017-02-27T15:11:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "90.1.71.230", "user_agent": "aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1038, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5653fb6e-6f9c-4ea7-aca6-04f2ecf09f1b", "eventTime": "2017-02-27T15:11:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "90.1.71.230", "userAgent": "aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJxOENSeVVOTW9YOEVtbU1tbWNFY1haRGd2K08yd29mT2JFYzlWVXB2N04xZkZBbVJuTHN5S0E4VjZYMUNZRTdVUHdzYTZFd1RHMTBIZE5xZnJ4bTFuV2NUVzRJTE1LV051UHo0WTUxRDVISVJYRjBTbDFkRE1TdUV2eEpyVWRBTHRmN0VwT2lGRVZUYUZ4a3FscHozWnc9PSIsImkiOiJGWXFJUFlWcTI3Q3pXaFN3TElOOTFRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b894aa25-1b72-437c-a8c3-f109609d024", "record_id": "flaws_cloudtrail:0000197:b894aa25-1b72-437c-a8c3-f109609d024", "row_index": 197, "timestamp": "2017-02-27T15:11:44Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "90.1.71.230", "user_agent": "aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1037, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b894aa25-1b72-437c-a8c3-f109609d024", "eventTime": "2017-02-27T15:11:44Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "90.1.71.230", "userAgent": "aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJhWStwVmsrci9nellaKzYxYzRidEh2MStDMkgzR2Jndk1kWk96N3ZvV0crVzdoZzV3RWVXWWxCeVZGVTlYbmd2VHlLMlRtejg0MVhmVUlHN3U3Q3RZcm1UNGdkUXBTeW95ZTY0ZDdoT2ZUQTZMZEE0WlJGUFhOUGV6NlNOMFgxMWtlNFBGamV4cXZNNVRXdTh2VUdHQlE9PSIsImkiOiJ3S3luSEJtWUZ1ZFR2RmdtaEpQY3dBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5af573f4-14cf-48de-ad31-74d61550b54a", "record_id": "flaws_cloudtrail:0000198:5af573f4-14cf-48de-ad31-74d61550b54a", "row_index": 198, "timestamp": "2017-02-27T15:11:46Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "90.1.71.230", "user_agent": "aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1038, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5af573f4-14cf-48de-ad31-74d61550b54a", "eventTime": "2017-02-27T15:11:46Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "90.1.71.230", "userAgent": "aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJ3dWVLRW5jZFA2Yjl3cm4yYS9SMnhRRGdlODdKUEpCeVdaVVNqWGJJbXE5NXhTWlJsR3lORTJOTHRMM1lTclgzQlRrc2M5ZzJVZXA0ZUxEVjR2c1NMNTdvbEVla2xIbDRoNkZKeXlPU0pCVkhHeWlXakNUenJITllrNVpNd0FMeWpIMmIrUVlXMmU5eTg2bHhUUFpxcUE9PSIsImkiOiJPUWJzLzFOWkRMWnRWcC8xRWRrQXpRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9d9520d6-ed21-4413-8cec-f255080cec60", "record_id": "flaws_cloudtrail:0000199:9d9520d6-ed21-4413-8cec-f255080cec60", "row_index": 199, "timestamp": "2017-02-27T15:11:49Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "90.1.71.230", "user_agent": "aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1038, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9d9520d6-ed21-4413-8cec-f255080cec60", "eventTime": "2017-02-27T15:11:49Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "90.1.71.230", "userAgent": "aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJ4MmFpQXVJeDRiWmxmRk0vWndSZVJmTXpVdFE3SHVkWkdSRll2ZEg2RUljNTRNS2h3cEk1WjJlTHRHWHF6d3I4ZkVrS0lBeEFRL1ZxZDVxQmpKWkpnNzlrTCs1ZmZiczAyM0s2NXB2M1R6NVA1TGxMcUxQSGhqMFI5cmVqWWpWV2VYSUZSTzk4Uy9iMTEvV25tbHZiQlE9PSIsImkiOiJtZXFibFVUbWd5VlNIT3VpK2psTm53PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8cd9377f-94ad-4306-922d-575947f153df", "record_id": "flaws_cloudtrail:0000200:8cd9377f-94ad-4306-922d-575947f153df", "row_index": 200, "timestamp": "2017-02-27T15:11:52Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "90.1.71.230", "user_agent": "aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1038, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8cd9377f-94ad-4306-922d-575947f153df", "eventTime": "2017-02-27T15:11:52Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "90.1.71.230", "userAgent": "aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJsNlg1ZjFtVTE4K1ZIVC9sNmpuQ2xSam5ncnpOQW1EcWxaeTFJV2JJN3Y0QUk1ZUhyUHNRTm8wenBSdisrOTdLQmkwWGVpZ2hOWi9OMzFXSnhnbjhDSHhuQXg1Ri82RWFTWjVBNGxmNE1uT2swZGdXdld2ZC9QaVpnMGNVUHR3VlVIMzRwSURTMGVHN0hZUVkvN3FHZlE9PSIsImkiOiJVeTV6NnJTYUxnTjZOM2IrNE8wKzRBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "079c1ea9-bb06-40b2-8170-984d722106f8c", "record_id": "flaws_cloudtrail:0000201:079c1ea9-bb06-40b2-8170-984d722106f8c", "row_index": 201, "timestamp": "2017-02-27T15:11:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "90.1.71.230", "user_agent": "aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1039, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "079c1ea9-bb06-40b2-8170-984d722106f8c", "eventTime": "2017-02-27T15:11:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "90.1.71.230", "userAgent": "aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJFQjlzTFBOMUQvaks4WVRFWHlYQWRXNFVNYnozc0cxQUVnSG1XYitraVVwTENFNFhDbGVNb24yVzBPSlh2Nnh3VEdLaTI0c0NwcU03RW9NRDk1YnNFdEZvaXhMT0ZzS1ltaFhpYnZFVnlLbUdUUGdNKy95bDBoN2F1b2pWQTVYSEd2WTZuREpoNW13TU42RmhZakNFQmc9PSIsImkiOiJPbWt3TGtaTllMcEh4c2NPNHp4Y0RnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a5b916991-ff37-4692-8638-21f7876ad689", "record_id": "flaws_cloudtrail:0000202:a5b916991-ff37-4692-8638-21f7876ad689", "row_index": 202, "timestamp": "2017-02-27T15:11:55Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "90.1.71.230", "user_agent": "aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1039, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a5b916991-ff37-4692-8638-21f7876ad689", "eventTime": "2017-02-27T15:11:55Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "90.1.71.230", "userAgent": "aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJRQk5jaVVldmFpdVNlNTh5NHJHSlVhRHNiU3l0d3kwbExLamNjVlF6UHYyZHBFYVlBenB5cFl3Z1lJNnFYdllRSkdNT3pkUmtjdWd4N04zUjJiSVBBY1gweG5rU0VTNUxiNFJIMjZIc25NL1hWVENaUjZNWU80U0dVajB6aU0vQytQbGxqVCtqSWRZZmx2N0tjSVBwZlE9PSIsImkiOiJQMDVlVkZ5ZVlqNU1qZmM4VVhWRGtRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "beb100586-1eaa-4307-9acd-992dafc93570", "record_id": "flaws_cloudtrail:0000203:beb100586-1eaa-4307-9acd-992dafc93570", "row_index": 203, "timestamp": "2017-02-27T15:13:49Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "90.1.71.230", "user_agent": "aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "beb100586-1eaa-4307-9acd-992dafc93570", "eventTime": "2017-02-27T15:13:49Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "90.1.71.230", "userAgent": "aws-cli/1.11.43 Python/2.7.13 Darwin/16.4.0 botocore/1.5.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "45c022b6-4cfa-4a6f-accf-94894daca824", "record_id": "flaws_cloudtrail:0000204:45c022b6-4cfa-4a6f-accf-94894daca824", "row_index": 204, "timestamp": "2017-02-27T15:26:49Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "140.14.253.197", "user_agent": "[aws-cli/1.11.13 Python/3.5.1+ Linux/4.4.0-22-generic botocore/1.4.70]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 651, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "45c022b6-4cfa-4a6f-accf-94894daca824", "eventTime": "2017-02-27T15:26:49Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "140.14.253.197", "userAgent": "[aws-cli/1.11.13 Python/3.5.1+ Linux/4.4.0-22-generic botocore/1.4.70]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "db1d4ea1-89d1-4926-bd03-8adf9d79e9cb", "record_id": "flaws_cloudtrail:0000205:db1d4ea1-89d1-4926-bd03-8adf9d79e9cb", "row_index": 205, "timestamp": "2017-02-27T15:31:45Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "143.24.250.167", "user_agent": "[aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 654, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "db1d4ea1-89d1-4926-bd03-8adf9d79e9cb", "eventTime": "2017-02-27T15:31:45Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "143.24.250.167", "userAgent": "[aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f2ef09dd-de3a-4cfa-8054-292399c6d695", "record_id": "flaws_cloudtrail:0000206:f2ef09dd-de3a-4cfa-8054-292399c6d695", "row_index": 206, "timestamp": "2017-02-27T15:36:02Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "143.24.250.167", "user_agent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f2ef09dd-de3a-4cfa-8054-292399c6d695", "eventTime": "2017-02-27T15:36:02Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "143.24.250.167", "userAgent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fab094fd-7179-4ef3-8252-4f14691f32", "record_id": "flaws_cloudtrail:0000207:fab094fd-7179-4ef3-8252-4f14691f32", "row_index": 207, "timestamp": "2017-02-27T15:36:06Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "143.24.250.167", "user_agent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fab094fd-7179-4ef3-8252-4f14691f32", "eventTime": "2017-02-27T15:36:06Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "143.24.250.167", "userAgent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJaeEJML1FxZHd1bHRhS0IrOXNjN3FOYWFVbGJtQ1IzbGRMYWhJRmpZRHFOeDhPMFpCNGtWQ3BRemE1UVBDZlJkRWpueTdHM0dRSmd2ZnltUGFFOUZJSHpUQ0IxWmNKVGlxVXNOcFlOSGhWRk14dkh0WVdtQnk5eU1hbi9EZXRUVUZJU1diWDNXV09mTys1RWpEMU92a2c9PSIsImkiOiI1MlZ0YVUzbnlZT09PQ3lTRU54bmNRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b52475-ee24-42c7-8135-24432d3aec7", "record_id": "flaws_cloudtrail:0000208:b52475-ee24-42c7-8135-24432d3aec7", "row_index": 208, "timestamp": "2017-02-27T15:36:10Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "143.24.250.167", "user_agent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1051, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b52475-ee24-42c7-8135-24432d3aec7", "eventTime": "2017-02-27T15:36:10Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "143.24.250.167", "userAgent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJsZHVsdmR0dWNaVFdHek9OMkEwOVRPVnNFNGRNL3ZFaGp3SzVWZlZ3RFlmZG5HUnFFSlc4eTBlWGF1aldxNzBrT2orK3o3L3hnZ01FTSswODdwaEpRODRUQWxFK0Y4NmhHNVdyU1hRbzYzUHFvRUVLWUFQVHpBdTFiYkRmL3drSUZKVDN1VW5BT3ZMTjlVMnM0SlBVWnc9PSIsImkiOiJRZHp1MzNIVVNOMmNCaTh4TjdvWTFnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bbfb5410-305e-4a77-a0bb-547bbdd200b3", "record_id": "flaws_cloudtrail:0000209:bbfb5410-305e-4a77-a0bb-547bbdd200b3", "row_index": 209, "timestamp": "2017-02-27T15:36:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "143.24.250.167", "user_agent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bbfb5410-305e-4a77-a0bb-547bbdd200b3", "eventTime": "2017-02-27T15:36:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "143.24.250.167", "userAgent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJvZDNGbytFamt2dGd4UFJRR3NBWUxZZGU5cGt3VTZJeHRwYmdpMW95Uk04Q3ZwRWx3UHcvcm9YUS9YbG5qUmZIVGFQd3pXTXNJQ1JuVjFTTktQcU9sRmdKbzA1cURQK2ZoQlRNK29wTjlRYzJWNUF5MVJDODJQM1VHUi9IUUhZZE95VTI4TG14WmF4UFc0eHJvZXQvREE9PSIsImkiOiI1SGxlNWhzTWRTZkNxVWhNM1dZemhnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9ffa6262-ee34-4a4b-9753-272159d3e60f1", "record_id": "flaws_cloudtrail:0000210:9ffa6262-ee34-4a4b-9753-272159d3e60f1", "row_index": 210, "timestamp": "2017-02-27T15:36:18Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "143.24.250.167", "user_agent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1056, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9ffa6262-ee34-4a4b-9753-272159d3e60f1", "eventTime": "2017-02-27T15:36:18Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "143.24.250.167", "userAgent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJQVGVUekVxaGx5MHJTRUVzWFAxc0hHaXRueG9iT2t6YVFaWS9nMXBJWThHK1RkQytCc2dtbXJ0TWZFRzNDWGZjb0F0Y1cyWEMvWDNJS1hJTmdQc3dVWHcrNlZITnRabkdSMW1temVQNHJWM0pGMm1kQU1mWmNpWmd0MjNQQk5acGZVaExZMTFZdUZENUw4dG1ZMXdhb2c9PSIsImkiOiJ0b0gwbkZDc0M5RThFNDYxb25vOVNnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "66b0b99e-106f-49da-970e-91e60a3747e4", "record_id": "flaws_cloudtrail:0000211:66b0b99e-106f-49da-970e-91e60a3747e4", "row_index": 211, "timestamp": "2017-02-27T15:36:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "143.24.250.167", "user_agent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "66b0b99e-106f-49da-970e-91e60a3747e4", "eventTime": "2017-02-27T15:36:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "143.24.250.167", "userAgent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiI0RUV5OFowcEIxOTJIY2h1NXNld1BxYmltdXdqMURBN24xZXFWc05mWFB5OEdnSjV5c3pSUVdldGRuYk5TYzRrZEZGVy8vdWhJRTRyYm1oWkRpSzJHc3p5RjJrSnFwb2E4ZVR5QTFST1k0TlIrVmo4bk1ndnJJNlgwZzduYmRDSFJRT1lVTUpNVjJrMlNpRDlPSU5QdWc9PSIsImkiOiJ3WHZNQmFEWGRKRS9sWDYxMDhmQVJnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6057c91e-6a68-400f-b355-469d266c5972", "record_id": "flaws_cloudtrail:0000212:6057c91e-6a68-400f-b355-469d266c5972", "row_index": 212, "timestamp": "2017-02-27T15:36:26Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "143.24.250.167", "user_agent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6057c91e-6a68-400f-b355-469d266c5972", "eventTime": "2017-02-27T15:36:26Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "143.24.250.167", "userAgent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJwOGtQT2JFTUh3ZG5KVHZ6VHd6Rk9wU1lKR0VTSEhTaklNQy9ENlJuaWRiSDEwNTNsZUZ3cHNsQW95eFA0QTNDVE0rTFFKeUhTWnBvaFpJS2NTRVMrcGVMQzYxQUEySzdheWV6d0tOaHk4SG54am1BRVR4b2RQVEdmclFFNnZEdUhyVXVRNGk0dmNITmZzV2RhUkZOeVE9PSIsImkiOiJBUks4czRPZkxqaFhtWlM3QjJWbkJ3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4d73eda0-b116-4135-978a-2bd6c6aeb62d", "record_id": "flaws_cloudtrail:0000213:4d73eda0-b116-4135-978a-2bd6c6aeb62d", "row_index": 213, "timestamp": "2017-02-27T15:36:28Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "143.24.250.167", "user_agent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4d73eda0-b116-4135-978a-2bd6c6aeb62d", "eventTime": "2017-02-27T15:36:28Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "143.24.250.167", "userAgent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJJUWd3a2UrOVpHUjhVNjZIYmFwMUY5dWhQajRNMWU1OVZ5YUFhdVB1MFNMeEJPWDRJcG9DUTM4RDFCcy9ROXRXWkpxbjdPRTNDcGFISVBRZzgvU2xSRXYxRk5uMzVwQitvdSs4SGZUK2RBc0VhRlpQb3JueXkzUDBZMFRYaSsvWUg0OGxOcGFOeTFNVFoyb0pNTWI5RHc9PSIsImkiOiJlTUFmYWJxMDc0WmlBUXJhd3F2dTNBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1fa0fa0a-ce65-4904-8d8e-6353303cd348", "record_id": "flaws_cloudtrail:0000214:1fa0fa0a-ce65-4904-8d8e-6353303cd348", "row_index": 214, "timestamp": "2017-02-27T15:38:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "143.24.250.167", "user_agent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1fa0fa0a-ce65-4904-8d8e-6353303cd348", "eventTime": "2017-02-27T15:38:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "143.24.250.167", "userAgent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf4138e8-976e-4302-aeec-e328b76a6978", "record_id": "flaws_cloudtrail:0000215:bf4138e8-976e-4302-aeec-e328b76a6978", "row_index": 215, "timestamp": "2017-02-27T15:38:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "143.24.250.167", "user_agent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1053, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf4138e8-976e-4302-aeec-e328b76a6978", "eventTime": "2017-02-27T15:38:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "143.24.250.167", "userAgent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJMODlNOW9PY2lFSkVteEhtdldibUsrWmlhSVJRQk5JUkp3THZsL2lGRFkwb2Ewc1dYYjh4T29MSGVQVThsbkMvM3RVTWRmMDFKZFRXaDRleVJLMkpKemFNWTQzajBaaFhLbGFtNlcyckM5NG9PV3RQMWZZdm85U2dERTRBZHJnVklvKzJmbk9BaXFkME8rVXVRNFFOT2c9PSIsImkiOiI0ZTNBL1dCSnN5eXFhckIvZWQ4dGJ3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ea3154c2-d510-4fec-ba24-bfabc314340b0", "record_id": "flaws_cloudtrail:0000216:ea3154c2-d510-4fec-ba24-bfabc314340b0", "row_index": 216, "timestamp": "2017-02-27T15:38:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "143.24.250.167", "user_agent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ea3154c2-d510-4fec-ba24-bfabc314340b0", "eventTime": "2017-02-27T15:38:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "143.24.250.167", "userAgent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJKSi9KYjYxT0tXcDFmMm82aURxeERZeDF0UDNZY2hUY0VEYlVXMXVyWFB3RzlGVEtNZW9XYjBCanN5N0tueGhGTVNiVkF4dEdPYkkwc0gxWDVLcW42Y2Njb0hZRTJlZXdKcXlsNjYxL0VKZjgrYmZMNHBJTTg0K1NPc1R5SDdTVmpOWkppRXhwdy9DVkkwN0hNNlZMNEE9PSIsImkiOiJLNXpxTE1HTDYrS3JveDVybVd4WDdRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ce510481-ee49-4c34-8a81-813175b0207", "record_id": "flaws_cloudtrail:0000217:ce510481-ee49-4c34-8a81-813175b0207", "row_index": 217, "timestamp": "2017-02-27T15:38:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "143.24.250.167", "user_agent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1053, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ce510481-ee49-4c34-8a81-813175b0207", "eventTime": "2017-02-27T15:38:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "143.24.250.167", "userAgent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJ6a20ySjczVWpBK1RLU0dqV0loUk9hdDdIQzBEQzJncXlzbUI2aWMrRlpMM0RrZHM0RjZEZ1IreEh2alFGSWVKTXZQZmJ1SFRiS0VQU3B6OTcxamNIcHI2YnFWZy9pRm1oenp4c2FEMzdqemlDU3BsVlh6U0hUL2ZuaFhORnJHMVkyTWlibXBrdkJyRUxCRHI0QmlBRVE9PSIsImkiOiJoUmNBeEpoWWQ1NVYyeHFpU3Jrb2NRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1fb42c88-66bc-4bc7-a319-fe7e40eb0511", "record_id": "flaws_cloudtrail:0000218:1fb42c88-66bc-4bc7-a319-fe7e40eb0511", "row_index": 218, "timestamp": "2017-02-27T15:38:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "143.24.250.167", "user_agent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1fb42c88-66bc-4bc7-a319-fe7e40eb0511", "eventTime": "2017-02-27T15:38:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "143.24.250.167", "userAgent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiI3ZFJBTUNYL052SXBtVXZXalVxYk5xS2M5WWxvMTdvbkZoZ2pUVEMxYTZBTHA5My9Ca3pEbkZGNXdQdDZacjhyeHVxaVBYUTZPUWhQQXBBVnZCbGRUYnVlV05vYVpaaWJqeXI2NzJzRGtOa2E5UCtWYVRBdXowV2kyemphNjdHU2lDVHpqSEFzSHc1MVdPVUpZRURFN2c9PSIsImkiOiJJd1NxZ2NmbTBFMzBZNkpyTlo4NTJRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b8ef8446-c1f2-4bf9-aca7-dcec8393b50f", "record_id": "flaws_cloudtrail:0000219:b8ef8446-c1f2-4bf9-aca7-dcec8393b50f", "row_index": 219, "timestamp": "2017-02-27T15:38:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "143.24.250.167", "user_agent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b8ef8446-c1f2-4bf9-aca7-dcec8393b50f", "eventTime": "2017-02-27T15:38:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "143.24.250.167", "userAgent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJ1SXA1d3VHYnN3UndUb2FGc3Fob1d1a2ZuTERDd3hFa2NpUkpLSENuczVqcnNDUlVMeUNDQXlHY0FxamduNXh6aVlDL1haSUVML1VvdXJHdTdpVzBYT2owR1JsRXNyVUs1UXo5bWYvWS9FRjRsbGU1NUkyTWdaQ2psWWVadm1PQU5SdG5QcEppUWs3VHdoRkJDbEhzMUE9PSIsImkiOiJBcUszN1M1cnJtUjNaUHlwUTVQaDh3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3d53000f-3068-46d3-869d-4c0f8ccf305a", "record_id": "flaws_cloudtrail:0000220:3d53000f-3068-46d3-869d-4c0f8ccf305a", "row_index": 220, "timestamp": "2017-02-27T15:38:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "143.24.250.167", "user_agent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3d53000f-3068-46d3-869d-4c0f8ccf305a", "eventTime": "2017-02-27T15:38:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "143.24.250.167", "userAgent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJLaDFGR2sxWEcwaHcza1JCdkNYTDl6K0JGOWdHOC9JMWlycGFzOEpJZTRDRnh2Ylcrb1Fzc21sZXRMSFN0ZWwwM2laVkNDck1LQ21PMVFqKzh6elkvWEo2c2JKWUhML09XNVBoZk9xOWl1WHpnOWhWbjJoR2c1WDZGTlZPK05aaE82N3Z5aTNpSHdBRlZIUnBKZ0k2eUE9PSIsImkiOiJZcVFNd1RaTTdZemNCNzFteHVNWE93PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "edcb3081-bf67-46af-bb5f-76a2f27a1d8e", "record_id": "flaws_cloudtrail:0000221:edcb3081-bf67-46af-bb5f-76a2f27a1d8e", "row_index": 221, "timestamp": "2017-02-27T15:38:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "143.24.250.167", "user_agent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "edcb3081-bf67-46af-bb5f-76a2f27a1d8e", "eventTime": "2017-02-27T15:38:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "143.24.250.167", "userAgent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJxOS9IZzJxdHlCZ2x2U1p4ZVpENkMxdzZ5K09xb3ZsdnJmdTlDQitBRVRhbVlUaVVFTG41Qjh1UnU2enZZRVlDMFRUNmcraVJaUXFEUnMxajJUeVVKbkxibVZXcUNYd3pSSHM5Q1lERFRDRnF1TnRCZktYZjMyWFVUVk1TNFdKTUgvSXNKNi91N0QzSDhjZzBkWmlJL3c9PSIsImkiOiJ4QzNNaWxyMUErazJHVCtiWEtRRFVRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b1a1b6d5-316c-4bd5-be47-37f00dd37a5b", "record_id": "flaws_cloudtrail:0000222:b1a1b6d5-316c-4bd5-be47-37f00dd37a5b", "row_index": 222, "timestamp": "2017-02-27T15:40:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "143.24.250.167", "user_agent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 797, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b1a1b6d5-316c-4bd5-be47-37f00dd37a5b", "eventTime": "2017-02-27T15:40:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "143.24.250.167", "userAgent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "127fd8c0-a65a-483b-899b-2e63f4258eb6", "record_id": "flaws_cloudtrail:0000223:127fd8c0-a65a-483b-899b-2e63f4258eb6", "row_index": 223, "timestamp": "2017-02-27T15:42:26Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "140.14.253.197", "user_agent": "aws-cli/1.11.13 Python/3.5.1+ Linux/4.4.0-22-generic botocore/1.4.70", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 779, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "127fd8c0-a65a-483b-899b-2e63f4258eb6", "eventTime": "2017-02-27T15:42:26Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "140.14.253.197", "userAgent": "aws-cli/1.11.13 Python/3.5.1+ Linux/4.4.0-22-generic botocore/1.4.70", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e2a45916-d214-4441-881a-ba76ddab4365", "record_id": "flaws_cloudtrail:0000224:e2a45916-d214-4441-881a-ba76ddab4365", "row_index": 224, "timestamp": "2017-02-27T15:42:57Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "140.14.253.197", "user_agent": "aws-cli/1.11.13 Python/3.5.1+ Linux/4.4.0-22-generic botocore/1.4.70", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 779, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e2a45916-d214-4441-881a-ba76ddab4365", "eventTime": "2017-02-27T15:42:57Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "140.14.253.197", "userAgent": "aws-cli/1.11.13 Python/3.5.1+ Linux/4.4.0-22-generic botocore/1.4.70", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6f45109-efcb-4651-952f-2d154c1689e6", "record_id": "flaws_cloudtrail:0000225:6f45109-efcb-4651-952f-2d154c1689e6", "row_index": 225, "timestamp": "2017-02-27T15:43:17Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "140.14.253.197", "user_agent": "aws-cli/1.11.13 Python/3.5.1+ Linux/4.4.0-22-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 793, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6f45109-efcb-4651-952f-2d154c1689e6", "eventTime": "2017-02-27T15:43:17Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "140.14.253.197", "userAgent": "aws-cli/1.11.13 Python/3.5.1+ Linux/4.4.0-22-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9e40832a-044b-4d65-ab1d-73baf3f3aa3a", "record_id": "flaws_cloudtrail:0000226:9e40832a-044b-4d65-ab1d-73baf3f3aa3a", "row_index": 226, "timestamp": "2017-02-27T15:45:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "143.24.250.167", "user_agent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 797, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9e40832a-044b-4d65-ab1d-73baf3f3aa3a", "eventTime": "2017-02-27T15:45:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "143.24.250.167", "userAgent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "95105d68-3c30-4c69-98f1-d669a05d1af6", "record_id": "flaws_cloudtrail:0000227:95105d68-3c30-4c69-98f1-d669a05d1af6", "row_index": 227, "timestamp": "2017-02-27T15:49:01Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "143.24.250.167", "user_agent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "95105d68-3c30-4c69-98f1-d669a05d1af6", "eventTime": "2017-02-27T15:49:01Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "143.24.250.167", "userAgent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "643f30a1-393b-4cda-b1f2-3564e1fd62fa", "record_id": "flaws_cloudtrail:0000228:643f30a1-393b-4cda-b1f2-3564e1fd62fa", "row_index": 228, "timestamp": "2017-02-27T15:49:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "143.24.250.167", "user_agent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 793, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "643f30a1-393b-4cda-b1f2-3564e1fd62fa", "eventTime": "2017-02-27T15:49:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "143.24.250.167", "userAgent": "aws-cli/1.11.40 Python/3.5.2 Linux/4.9.9-200.fc25.x86_64 botocore/1.5.3", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "49a99256-904d-4df0-b522-6e493e58c77a", "record_id": "flaws_cloudtrail:0000229:49a99256-904d-4df0-b522-6e493e58c77a", "row_index": 229, "timestamp": "2017-02-27T16:07:41Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1477, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "49a99256-904d-4df0-b522-6e493e58c77a", "eventTime": "2017-02-27T16:07:41Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIACND8SKJDVGOSG4OW", "expiration": "Feb 27, 2017 10:24:43 PM", "sessionToken": "FQoDYXdzEEkaDFkHVbgbNa/azsn4+CK3A/E7l1Miqmd2kSWgwgMC9Bn+TUrY1K9zzFvOMdSf8vtgwEyGzDCdnHskDMx7pc6ZpCeg+gubgYTMTIVi/qVBQRSatQM5KUqH4GMF8+FJnvegOa+My4/nwbxDTU2GR5/g2VvhvuhmMKJ3FyNEM/1+EgGe3S3CLeRU67dKV219lxR0Lg3W5OvT6wopHz5ODtTRrd59wzeRkUrqBF9C9WzFLtQkYVx5FDVYdmqDGbyMFdblsB21qkitDPYG64RPGA2HkyP2tseGLH0KY1CITIJaZe/hPtcOLcNyBQxcTsaJ7E+F/5xBekilTgGJXGHd68CZTaXDOUX/F6/4cCr52dGSOcG5s+HB/tIJdfKWsYmO/8XrugCYoYz5PXAlXsGOICivxO5txOWEzJxGTax0aGbOjO/xobDT1X6nIN1z062iz8didP0orItMbYK5GUwUMdcB1wN4x3BwcM7UQFsCitfqrQUl7+1GQKPsrul0iMYU89gzVWgit9c8z6uTx08dZ08Sg/c/zVSeKRS7bUbqJi4QFnF0k5z3cnRRqQX/xLKaiNGyrPDZxb4tscR3QfbVJXBbJ4XdV9odKMsozZ3RxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3c39445a-87fd-44ee-a2db-188235b94c09", "record_id": "flaws_cloudtrail:0000230:3c39445a-87fd-44ee-a2db-188235b94c09", "row_index": 230, "timestamp": "2017-02-27T16:58:36Z", "event_type": "GetSessionToken", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "0.229.250.9", "user_agent": "aws-cli/1.9.21 Python/2.7.10 Darwin/15.6.0 botocore/1.3.23", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1042, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3c39445a-87fd-44ee-a2db-188235b94c09", "eventTime": "2017-02-27T16:58:36Z", "eventName": "GetSessionToken", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "0.229.250.9", "userAgent": "aws-cli/1.9.21 Python/2.7.10 Darwin/15.6.0 botocore/1.3.23", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"credentials": {"accessKeyId": "ASIAILFCY7L61F13EZBW", "expiration": "Feb 28, 2017 4:58:36 AM", "sessionToken": "FQoDYXdzEEoaDNdyyXS9b0pXK5AZMiKsAQybKRhwidZYEKyWmeiMcFhSD5MU4KzNAaUqzLU2U5nq41A3siLPiAZicCnIjkpjI/vyxh8RqAvxYj60ErqfJXRHc6fiQw1cOBMsyUhemvaBpQbKda/NYmPDOkrgoxbZk6/1PJUvIl9BbkOAEFBkmjmLMEeC8XOgcAJQtvALu30SKeEB7q5cGOVOyOs18yvHZxISQYuurIu1A2KQBZ9QNV+e/er9X1iZmQM17+0ovLXRxQU="}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a3f1651f-1f08-4670-a18e-d54959a066e7", "record_id": "flaws_cloudtrail:0000231:a3f1651f-1f08-4670-a18e-d54959a066e7", "row_index": 231, "timestamp": "2017-02-27T16:58:39Z", "event_type": "GetSessionToken", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "0.229.250.9", "user_agent": "aws-cli/1.9.21 Python/2.7.10 Darwin/15.6.0 botocore/1.3.23", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1042, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a3f1651f-1f08-4670-a18e-d54959a066e7", "eventTime": "2017-02-27T16:58:39Z", "eventName": "GetSessionToken", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "0.229.250.9", "userAgent": "aws-cli/1.9.21 Python/2.7.10 Darwin/15.6.0 botocore/1.3.23", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"credentials": {"accessKeyId": "ASIAY2W222W04VBWKM6X", "expiration": "Feb 28, 2017 4:58:39 AM", "sessionToken": "FQoDYXdzEEoaDOSXJtQDS4E6FUJWiSKsAQgZpIT39FNfZkDYw3HbMoXn8S8iXQmK7y0uap5IY6euewJY1Nh5jBpMJC5E9nhofv0H7so1hmyZePWmG6ZeY0giWxJwd9t9Hubr5hLqQoZrBQELT3RPlTL1qmJdt8ORL0cIymNrs2sZ8NTFQdKE0zYzQX1hDSpNT9RQoiKQdf3fjZHBeEljXUjue3rNhCoTdVo1qDQQJFlfJW6gHrk0EGokolC1p5phzWs28YIov7XRxQU="}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6c77a013-dd49-4343-8b71-b92c1d4d8813", "record_id": "flaws_cloudtrail:0000232:6c77a013-dd49-4343-8b71-b92c1d4d8813", "row_index": 232, "timestamp": "2017-02-27T17:08:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1479, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6c77a013-dd49-4343-8b71-b92c1d4d8813", "eventTime": "2017-02-27T17:08:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAJ91I8YI4R0XO55PF", "expiration": "Feb 27, 2017 11:30:28 PM", "sessionToken": "FQoDYXdzEEoaDFSAbgXMPB1sdx1k6CK3A18+lx8yZW+7DZL5KRhOUpmuJ0RtDj9xlPfqfqS2jD2KDza6DWcYvgbZnU6gmtQE9lgZR6oGCraVj64b1k9xrE5icfGh6or0BRZNvU2jtiqJyQDgtj1Aw6zm6dVq/nL2BJnJv0gVEit41PdJHQEQdo1WWiD3ZJ2GBmUJuD4TljAtOBts9F33y4oi53iH6gCkrT7dnHrP9xhW6BD4qrA0nsLvZt16uGTR60qirj141m/069IzquEZ9NA0TBY4PCuGEhzHLgwKX8ICpznfxAPb9BvQ3z1rVoQpakgpCDVzYrMEKsg+4kfaBTS5Se7pLUVAYqfoklUxH5+aO48M5zmTv9ikS34Ujvw/+JM9EOXJrHmQXRi8VL/ynPerj8SF6GzFrFqdhsOGJoRXfu2CN54mtbvvvHM+Pgt1mSfVVKh1QjroKtsJ25MAzNWHp71n+nXMlPVrTcWF5s8KL9/CEGUcFRj/l3AnkfOUDgdVRawOQD5BhbRwCJ3Xki3t90vSqWCvWFJ+JZSAyrPc3x7P9QokXkNr4i4ZN+17EOMyeZSZQoexKYXe3iJPXiMuJVtU1gHsGtzM9ZYql3co/bnRxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "977336bdd-e88a-4f8d-a793-3436f220ff97", "record_id": "flaws_cloudtrail:0000233:977336bdd-e88a-4f8d-a793-3436f220ff97", "row_index": 233, "timestamp": "2017-02-27T18:08:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1481, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "977336bdd-e88a-4f8d-a793-3436f220ff97", "eventTime": "2017-02-27T18:08:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAW13LKY9A8JWGOEJJ", "expiration": "Feb 28, 2017 12:35:05 AM", "sessionToken": "FQoDYXdzEEsaDFEKzJYu50GDH/K62iK3A0kyvuIQxlw4Wtz+5a68YapJk9/LYljI5HrwHDPtBqyQGLOce99ViL6dq/UHUVm/qqyRQ0k9N9OwBjPJveFrERS8hCKfhtIOmfZ3fviPQXsMgApYIaoBxu3fCq5af/3ncxnTzTk34C4tKei6um59HyoLosOWk59UKBA5Ac6yT40K0kSB3CJ4KU96fp4EtyYOd3SDuga4txH3PGHJj7PVok6rdmwR/9X7lBiuo4dHyOc71QxsplsQQPoQsTPX6ijiWcNVQPe+R0G1rbKMPZG/wUe9sN1QIkh5mLYbnRr+/MtjeGixZ4OrPV+OoEspqDW0TVNimzuErLwn7z+348GLw0LY0BV4fsOAa4X26zSKFqr6w4vAkuAj2fH7l4z0Rgofz9AeP039NpzY3/69TOeTEZkAOh3DKrXdQjIf/mOesa5qSpyng0D13r+rpsGiKYXsvkYzdfHwc80kNw01fxidPJq2GFh9smZdV8cDIPQtbm4pgT6amokBa+Laxey9s198yyH3BgDgsvGIbjwFzt9irEtLcmf7QyUUvJP5RKqiaXxjX92x4EKdFUJ/ILrKGfC/BungrK6uBz0oltbRxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fd8ba9c6-e560-44f9-9532-ead6df10d1a2", "record_id": "flaws_cloudtrail:0000234:fd8ba9c6-e560-44f9-9532-ead6df10d1a2", "row_index": 234, "timestamp": "2017-02-27T18:33:32Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "136.195.245.225", "user_agent": "[aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 657, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fd8ba9c6-e560-44f9-9532-ead6df10d1a2", "eventTime": "2017-02-27T18:33:32Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "136.195.245.225", "userAgent": "[aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5cfb4ba2-e160-4bac-9c2e-f0e746211e92", "record_id": "flaws_cloudtrail:0000235:5cfb4ba2-e160-4bac-9c2e-f0e746211e92", "row_index": 235, "timestamp": "2017-02-27T18:45:24Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "136.195.245.225", "user_agent": "[aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 657, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5cfb4ba2-e160-4bac-9c2e-f0e746211e92", "eventTime": "2017-02-27T18:45:24Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "136.195.245.225", "userAgent": "[aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4d51bc38-bd74-4c80-9797-5e46e2631fec", "record_id": "flaws_cloudtrail:0000236:4d51bc38-bd74-4c80-9797-5e46e2631fec", "row_index": 236, "timestamp": "2017-02-27T18:47:40Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "136.195.245.225", "user_agent": "[aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 658, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4d51bc38-bd74-4c80-9797-5e46e2631fec", "eventTime": "2017-02-27T18:47:40Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "136.195.245.225", "userAgent": "[aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c9924c38-a41a-4b6c-b898-0d41283de1f9", "record_id": "flaws_cloudtrail:0000237:c9924c38-a41a-4b6c-b898-0d41283de1f9", "row_index": 237, "timestamp": "2017-02-27T19:08:44Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1478, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c9924c38-a41a-4b6c-b898-0d41283de1f9", "eventTime": "2017-02-27T19:08:44Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAXGMW7ZSH3VWVIL4Y", "expiration": "Feb 28, 2017 1:13:15 AM", "sessionToken": "FQoDYXdzEEwaDCr3v8aJRToKSZnBbiK3A/rU6dW3PAgMt1hpHSBH8GW9psFdq07YdhfFXEQKKX7FyHY40iHd4LMcFOp+k2c8fGzt/h7/jM3OvX4/yuiZOBtxwqcElzdDdrKz4ZynPC2DwxlUt8mIVtnWpXbj0WboGkWYn6LHew7y+eP7msnVZpnNWtJqTEkoNpA/y/gC3z2nuUJOxRkbKyn/J8dkr2NcKvyO8sIPojvCSZxv46aa3d5Wj0PaQ6DDM8llYYxY7XUh8ri6ZUsn8sGQTzfIxcXJGns1BLd0e75/wbcf1SlT+N15UlYUmy96ws9SvS22OQsPUPKuJtqLOJIATieas23mPvPy+p43OQGOnHmsgUKAFnKU9ihRH/9Rhl5YkLZJliqxlDOk4iGSRVzUubBFk3BT5pcgnmzsCgQAlw+taozE9666n0eKhXgMPMK1WDoo1DMdFW5PX6lChLKPfZEKxNbRSSBWfwrDQZ7ZFQz1m3Qlos7uGb4Vi3b1TJNNA3rTc/NWOXg8Gn31ekBmB0XuxpI2kTHbcPE5uYe+ZNp4hv7ClkBI7mPndFmt5v79iBm0cAu8q2NbHD9kot2N+hYMx91RBa//DCWpJjIovPLRxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "03cae736-aee3-479a-8755-a85513bad3f", "record_id": "flaws_cloudtrail:0000238:03cae736-aee3-479a-8755-a85513bad3f", "row_index": 238, "timestamp": "2017-02-27T19:13:24Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.165.77.250", "user_agent": "[aws-cli/1.5.2 Python/2.7.8 Linux/4.9.0-1-amd64]", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 629, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "03cae736-aee3-479a-8755-a85513bad3f", "eventTime": "2017-02-27T19:13:24Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.165.77.250", "userAgent": "[aws-cli/1.5.2 Python/2.7.8 Linux/4.9.0-1-amd64]", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7aeb9a64-ff49-47ef-95cc-7ef8148291a7", "record_id": "flaws_cloudtrail:0000239:7aeb9a64-ff49-47ef-95cc-7ef8148291a7", "row_index": 239, "timestamp": "2017-02-27T19:16:35Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.254.12.255", "user_agent": "aws-cli/1.11.51 Python/2.7.12 Linux/4.4.0-64-generic botocore/1.5.14", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 777, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7aeb9a64-ff49-47ef-95cc-7ef8148291a7", "eventTime": "2017-02-27T19:16:35Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.254.12.255", "userAgent": "aws-cli/1.11.51 Python/2.7.12 Linux/4.4.0-64-generic botocore/1.5.14", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b16eb8eb-fbcc-4bfb-8813-8fd32f096492", "record_id": "flaws_cloudtrail:0000240:b16eb8eb-fbcc-4bfb-8813-8fd32f096492", "row_index": 240, "timestamp": "2017-02-27T19:17:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.254.12.255", "user_agent": "aws-cli/1.11.51 Python/2.7.12 Linux/4.4.0-64-generic botocore/1.5.14", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b16eb8eb-fbcc-4bfb-8813-8fd32f096492", "eventTime": "2017-02-27T19:17:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.254.12.255", "userAgent": "aws-cli/1.11.51 Python/2.7.12 Linux/4.4.0-64-generic botocore/1.5.14", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "02ca19b9-49f5-440a-ae00-fb279d3085d3", "record_id": "flaws_cloudtrail:0000241:02ca19b9-49f5-440a-ae00-fb279d3085d3", "row_index": 241, "timestamp": "2017-02-27T19:18:14Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.165.77.250", "user_agent": "[aws-cli/1.5.2 Python/2.7.8 Linux/4.9.0-1-amd64]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 629, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "02ca19b9-49f5-440a-ae00-fb279d3085d3", "eventTime": "2017-02-27T19:18:14Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.165.77.250", "userAgent": "[aws-cli/1.5.2 Python/2.7.8 Linux/4.9.0-1-amd64]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "788a86c2-a421-4983-bc87-3aa3d1ec733c", "record_id": "flaws_cloudtrail:0000242:788a86c2-a421-4983-bc87-3aa3d1ec733c", "row_index": 242, "timestamp": "2017-02-27T19:18:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.254.12.255", "user_agent": "aws-cli/1.11.51 Python/2.7.12 Linux/4.4.0-64-generic botocore/1.5.14", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "788a86c2-a421-4983-bc87-3aa3d1ec733c", "eventTime": "2017-02-27T19:18:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.254.12.255", "userAgent": "aws-cli/1.11.51 Python/2.7.12 Linux/4.4.0-64-generic botocore/1.5.14", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJJNmpqSjI3NW9kYUhnQkxuZ2Y1TWR5eWY5aW9XSy9VMU9nS3JxUzVtMS95eUw0R01QUXNCdlkxcVdmNWN5YVVURmFRN204N2h0N2RUd1kyS3BCWFdUbHhic2R2UFdxTDJPaXdwanBZTlR1UkZYcUZXcHRuZCtEeXd3czAvNnhnWnRobU1HeGlnQ3BsV2tnL0VaWUs3c0E9PSIsImkiOiJZcDVWVytJekluS29TeUJ5WWMwYjlnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e1b31b34-41f5-464d-b2d7-a9d2674d293f", "record_id": "flaws_cloudtrail:0000243:e1b31b34-41f5-464d-b2d7-a9d2674d293f", "row_index": 243, "timestamp": "2017-02-27T19:18:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.254.12.255", "user_agent": "aws-cli/1.11.51 Python/2.7.12 Linux/4.4.0-64-generic botocore/1.5.14", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e1b31b34-41f5-464d-b2d7-a9d2674d293f", "eventTime": "2017-02-27T19:18:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.254.12.255", "userAgent": "aws-cli/1.11.51 Python/2.7.12 Linux/4.4.0-64-generic botocore/1.5.14", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJ2SUc0bUZkdTUzNExFZ1g5Q25SdVJ6UVFveUhWdkhRMVpPUXVwamtKM0NwWXl5b1ZhTDRhNWI0WmtFRDAyeTJjSlAzdk5TaVFqZDRvN0hzc1dCQ011Vmo0SGdMenJxVFdRU01uakFJWHFDaVZDT2REYlc4RERTclRQcjcxamtQR3hwR2JTN0xSdXVPeFNQZjJLMkF0VWc9PSIsImkiOiJ1VkVUUi9tOU5xZEZIZ2Y1Vm9TT0xRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "000c451b-eec4-41e8-9d8d-f0e4c908fdb5", "record_id": "flaws_cloudtrail:0000244:000c451b-eec4-41e8-9d8d-f0e4c908fdb5", "row_index": 244, "timestamp": "2017-02-27T19:19:05Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1214, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "000c451b-eec4-41e8-9d8d-f0e4c908fdb5", "eventTime": "2017-02-27T19:19:05Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIAN4AJ104O9WZVZBR9", "expiration": "Feb 28, 2017 7:19:05 AM", "sessionToken": "FQoDYXdzEEwaDNDP7jXL34KF9gp6xyLfAYkeE2mh3FYjOrMia49mK0yXXUguDAzGQTVuEPcCeZARYc0VRAPZxUiSjBE1jUbEhBSHBR/+/nqXnvkmNHBzuugfJmilDVHITWy1tfDXihqjKOW5S1lNzuehErxM8pqLeODc6H1cGxrlKKiARp7mv9OqA2U/FuyYyUlZVADTC8ATGdhvP1bU1/BSOOR90I+K0lpFywL+7u/tklhgcBP/pMGaBOB1p4gumhYrPyBIbPGHDSh+VScp3p4OwrsYK8465XTeWWeZTpc3oFW6SvevndBRvDCxb5WcD5xJ1eIAHWooqffRxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4e4ba793-7e0c-4be3-8c30-af091368d629", "record_id": "flaws_cloudtrail:0000245:4e4ba793-7e0c-4be3-8c30-af091368d629", "row_index": 245, "timestamp": "2017-02-27T19:19:05Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAN4AJ104O9WZVZBR9", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "3.241.24.248", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1029, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4e4ba793-7e0c-4be3-8c30-af091368d629", "eventTime": "2017-02-27T19:19:05Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.241.24.248", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAN4AJ104O9WZVZBR9", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-02-27T19:19:05Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logStreamName": "2017/02/27/[$LATEST]b740335b258d6d2e5a916e534d54acbd", "logGroupName": "/aws/lambda/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "42b49a61-69e0-4e3c-a62e-24c4d9792e95", "record_id": "flaws_cloudtrail:0000246:42b49a61-69e0-4e3c-a62e-24c4d9792e95", "row_index": 246, "timestamp": "2017-02-27T19:19:06Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.254.12.255", "user_agent": "aws-cli/1.11.51 Python/2.7.12 Linux/4.4.0-64-generic botocore/1.5.14", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1043, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "42b49a61-69e0-4e3c-a62e-24c4d9792e95", "eventTime": "2017-02-27T19:19:06Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.254.12.255", "userAgent": "aws-cli/1.11.51 Python/2.7.12 Linux/4.4.0-64-generic botocore/1.5.14", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiI5V0JoYVhBTTEzUm1uTC9GZEZvTFVPa0IwazMyT2NWZXQwbHdyTHRJUnpmNDBjb1ZBZ2xTeENhSitiUm1UR0FCemxoZUxOb3pWM1NvSWZpbFpscm5PS3lFTnk4NmdKMFVjdGVGV3JodzYxNm1WclFhSjdEelNoUUpCR05WanI4QlgrTk1rN3Nzb0tYeVhObWNXN0tXNVE9PSIsImkiOiJsKzJrNnFBZWw5N3lDaWFybEM4eW9BPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eae0220a-d1ed-478a-ba1d-5acfb07b4b04", "record_id": "flaws_cloudtrail:0000247:eae0220a-d1ed-478a-ba1d-5acfb07b4b04", "row_index": 247, "timestamp": "2017-02-27T19:19:40Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.254.12.255", "user_agent": "aws-cli/1.11.51 Python/2.7.12 Linux/4.4.0-64-generic botocore/1.5.14", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eae0220a-d1ed-478a-ba1d-5acfb07b4b04", "eventTime": "2017-02-27T19:19:40Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.254.12.255", "userAgent": "aws-cli/1.11.51 Python/2.7.12 Linux/4.4.0-64-generic botocore/1.5.14", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJQU1IvNVBNR3k1MDFaZzJzUnU4bzFSK3lGWG5EKzlqWGI2WU1rc204d21DRHRkdVlqVWYzdmVtNlBFZEF3QmdwQW1iSjJ5SkZpelZYS1BMcjE3QStXaVhNU2pxN3FEYkdXaHE3VW5Ta2FvbFUxRk9Vakt0SHNOUFU0eXdkWUNwdEZ6dFpIWXk0Mk9VLzgrZEdFSmtmWEE9PSIsImkiOiJ0eG5udm4raDloSVRpZkpmSUcyb2VnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "af044305-5790-4542-9315-f061708ae4", "record_id": "flaws_cloudtrail:0000248:af044305-5790-4542-9315-f061708ae4", "row_index": 248, "timestamp": "2017-02-27T19:19:42Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.165.77.250", "user_agent": "aws-cli/1.5.2 Python/2.7.8 Linux/4.9.0-1-amd64", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 680, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "af044305-5790-4542-9315-f061708ae4", "eventTime": "2017-02-27T19:19:42Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.165.77.250", "userAgent": "aws-cli/1.5.2 Python/2.7.8 Linux/4.9.0-1-amd64", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c3b6847f-f33f-42c2-afe1-3e2bcfc89e55", "record_id": "flaws_cloudtrail:0000249:c3b6847f-f33f-42c2-afe1-3e2bcfc89e55", "row_index": 249, "timestamp": "2017-02-27T19:20:02Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.254.12.255", "user_agent": "aws-cli/1.11.51 Python/2.7.12 Linux/4.4.0-64-generic botocore/1.5.14", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c3b6847f-f33f-42c2-afe1-3e2bcfc89e55", "eventTime": "2017-02-27T19:20:02Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.254.12.255", "userAgent": "aws-cli/1.11.51 Python/2.7.12 Linux/4.4.0-64-generic botocore/1.5.14", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJ6M081eVM0TU1wMFVsS3NRMjJ3SS9XNWN4RVV5RmdMTTkvR1c1SVU0dG5YTExqRnltK081MTE2b2VIRlhRbTlQRExiekVPZmg1VW0wc2NCaWFEMzI1NWM1QTdpbko3WWYxb3oyQVhkQkJ6Z0I2aHY1ejZFcndOV1dnRXZKbW1PSGZOZXNyNGR6RHJNZG9GdC9vMkI3VVE9PSIsImkiOiJ0c0d6anY0RCsvSXk4U1NzN1AzSGJRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a164411-c530-4e80-8c69-c9a43bbb779b", "record_id": "flaws_cloudtrail:0000250:a164411-c530-4e80-8c69-c9a43bbb779b", "row_index": 250, "timestamp": "2017-02-27T19:20:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.165.77.250", "user_agent": "aws-cli/1.5.2 Python/2.7.8 Linux/4.9.0-1-amd64", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 717, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a164411-c530-4e80-8c69-c9a43bbb779b", "eventTime": "2017-02-27T19:20:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.165.77.250", "userAgent": "aws-cli/1.5.2 Python/2.7.8 Linux/4.9.0-1-amd64", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ee5888b9-c217-4c1f-9a86-9c046ef0d668", "record_id": "flaws_cloudtrail:0000251:ee5888b9-c217-4c1f-9a86-9c046ef0d668", "row_index": 251, "timestamp": "2017-02-27T19:20:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.254.12.255", "user_agent": "aws-cli/1.11.51 Python/2.7.12 Linux/4.4.0-64-generic botocore/1.5.14", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ee5888b9-c217-4c1f-9a86-9c046ef0d668", "eventTime": "2017-02-27T19:20:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.254.12.255", "userAgent": "aws-cli/1.11.51 Python/2.7.12 Linux/4.4.0-64-generic botocore/1.5.14", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiIxYWpHQXRhcFdzaUhlM1o4bUhqZkFyTmN3TWJYSERLaW9mc0lBNHo3Q1pIMlg3ZzdxUDg1aFZscjdCSDdwM0xzMmJIZ2U2TjFuVzY5N1RicmI3aUMramRxNEtWKzNIcUZwS3M1WEcxSXFHcllUQitaUDRJenUrYmhJRXUyR0s2K3orYnlmREV4ZmFjVDJrN3M3bWpzY0E9PSIsImkiOiJjSVNZbGVnckJXL3R5YjdLVHdaNEV3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4311eb62-d994-42ca-8c65-80c04e051373f", "record_id": "flaws_cloudtrail:0000252:4311eb62-d994-42ca-8c65-80c04e051373f", "row_index": 252, "timestamp": "2017-02-27T19:20:46Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.165.77.250", "user_agent": "aws-cli/1.5.2 Python/2.7.8 Linux/4.9.0-1-amd64", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 685, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4311eb62-d994-42ca-8c65-80c04e051373f", "eventTime": "2017-02-27T19:20:46Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.165.77.250", "userAgent": "aws-cli/1.5.2 Python/2.7.8 Linux/4.9.0-1-amd64", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2637cf9c-bfeb-4dfc-8b3a-81bffd63e867", "record_id": "flaws_cloudtrail:0000253:2637cf9c-bfeb-4dfc-8b3a-81bffd63e867", "row_index": 253, "timestamp": "2017-02-27T19:20:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.254.12.255", "user_agent": "aws-cli/1.11.51 Python/2.7.12 Linux/4.4.0-64-generic botocore/1.5.14", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2637cf9c-bfeb-4dfc-8b3a-81bffd63e867", "eventTime": "2017-02-27T19:20:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.254.12.255", "userAgent": "aws-cli/1.11.51 Python/2.7.12 Linux/4.4.0-64-generic botocore/1.5.14", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiIzK0I4RGdKMWJwTnNVT1FITkhlQnZQcnpQYlV4R0VSK2NVWHk4L3I0aWpFZXp3MkY5NVBQa25Ubkc1aUVvNUM3VmRRekNsS2NlYnlyOWdPT25RRU1zeDBVWUQ2NnFuQjd2anNmZzVXaVp1dWE3eFVPR3hDRkdWUExpWnlPUUZ1cTNQUUVwbnkzZk5LMy8rTXNhem9hVHc9PSIsImkiOiJRbFhGYVdjU01HcEVsdm12QVgzSmtnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b9a8f7ce-2303-4f22-a3e8-c5dd66e6a31c", "record_id": "flaws_cloudtrail:0000254:b9a8f7ce-2303-4f22-a3e8-c5dd66e6a31c", "row_index": 254, "timestamp": "2017-02-27T19:20:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.165.77.250", "user_agent": "aws-cli/1.5.2 Python/2.7.8 Linux/4.9.0-1-amd64", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 718, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b9a8f7ce-2303-4f22-a3e8-c5dd66e6a31c", "eventTime": "2017-02-27T19:20:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.165.77.250", "userAgent": "aws-cli/1.5.2 Python/2.7.8 Linux/4.9.0-1-amd64", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fcb548b7-5afe-4db6-a954-6f59cbf6d488", "record_id": "flaws_cloudtrail:0000255:fcb548b7-5afe-4db6-a954-6f59cbf6d488", "row_index": 255, "timestamp": "2017-02-27T19:35:23Z", "event_type": "DescribeExportTasks", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.165.77.250", "user_agent": "aws-cli/1.5.2 Python/2.7.8 Linux/4.9.0-1-amd64", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 674, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fcb548b7-5afe-4db6-a954-6f59cbf6d488", "eventTime": "2017-02-27T19:35:23Z", "eventName": "DescribeExportTasks", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.165.77.250", "userAgent": "aws-cli/1.5.2 Python/2.7.8 Linux/4.9.0-1-amd64", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"exportTaskIdSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b0b5231c-4e62-408e-b434-281a79dc7a28", "record_id": "flaws_cloudtrail:0000256:b0b5231c-4e62-408e-b434-281a79dc7a28", "row_index": 256, "timestamp": "2017-02-27T19:36:46Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.165.77.250", "user_agent": "aws-cli/1.5.2 Python/2.7.8 Linux/4.9.0-1-amd64", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 740, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b0b5231c-4e62-408e-b434-281a79dc7a28", "eventTime": "2017-02-27T19:36:46Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.165.77.250", "userAgent": "aws-cli/1.5.2 Python/2.7.8 Linux/4.9.0-1-amd64", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-4fd281251b99202a3", "attributeType": "CREATE_VOLUME_PERMISSION"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a62af2e7-9474-42da-b2d0-b75b739371", "record_id": "flaws_cloudtrail:0000257:a62af2e7-9474-42da-b2d0-b75b739371", "row_index": 257, "timestamp": "2017-02-27T19:36:52Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.165.77.250", "user_agent": "aws-cli/1.5.2 Python/2.7.8 Linux/4.9.0-1-amd64", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 727, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a62af2e7-9474-42da-b2d0-b75b739371", "eventTime": "2017-02-27T19:36:52Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.165.77.250", "userAgent": "aws-cli/1.5.2 Python/2.7.8 Linux/4.9.0-1-amd64", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-4fd281251b99202a3", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4d745ac0-c93c-432d-ae34-9e8356d44d70", "record_id": "flaws_cloudtrail:0000258:4d745ac0-c93c-432d-ae34-9e8356d44d70", "row_index": 258, "timestamp": "2017-02-27T19:38:50Z", "event_type": "GetSessionToken", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.165.77.250", "user_agent": "aws-cli/1.5.2 Python/2.7.8 Linux/4.9.0-1-amd64", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1031, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4d745ac0-c93c-432d-ae34-9e8356d44d70", "eventTime": "2017-02-27T19:38:50Z", "eventName": "GetSessionToken", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.165.77.250", "userAgent": "aws-cli/1.5.2 Python/2.7.8 Linux/4.9.0-1-amd64", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"credentials": {"accessKeyId": "ASIAAA0KJLT8OQ3BF3YP", "expiration": "Feb 28, 2017 7:38:50 AM", "sessionToken": "FQoDYXdzEE0aDLbO7TKaEjMDQNFEayKsAYVfhDuTmcC8u/spExXvyDDFaOzpBhZzbmrwdBP+M9bvLSG9fCULgaiKlLtMwMuKEqAFj8LRQwwXlKC3/AoqsYWPwfBJmESkN7JS/pqzJ7dfRYjka/E8jjmBAdTSRis29b45S/SNGEegWIVFwP/K9CPTVOgT5c0H8UqAJiOyagkqMfrxj4WSKIgISX9S3pvFfxlq4g4dRNZQso+Wj4R/+yHs1/MXAZpO+cZX0TMoyoDSxQU="}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ff6fe50-d2cf-4b22-a253-ff7d953002f", "record_id": "flaws_cloudtrail:0000259:7ff6fe50-d2cf-4b22-a253-ff7d953002f", "row_index": 259, "timestamp": "2017-02-27T19:39:15Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.165.77.250", "user_agent": "aws-cli/1.5.2 Python/2.7.8 Linux/4.9.0-1-amd64", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 751, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ff6fe50-d2cf-4b22-a253-ff7d953002f", "eventTime": "2017-02-27T19:39:15Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.165.77.250", "userAgent": "aws-cli/1.5.2 Python/2.7.8 Linux/4.9.0-1-amd64", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4b02ed6b-5e7a-46fd-a440-696e1c8385a3", "record_id": "flaws_cloudtrail:0000260:4b02ed6b-5e7a-46fd-a440-696e1c8385a3", "row_index": 260, "timestamp": "2017-02-27T19:58:18Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.203.251.64", "user_agent": "[aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 656, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4b02ed6b-5e7a-46fd-a440-696e1c8385a3", "eventTime": "2017-02-27T19:58:18Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.203.251.64", "userAgent": "[aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4efdc38c-7d18-4e81-9fa8-469a4a64b147", "record_id": "flaws_cloudtrail:0000261:4efdc38c-7d18-4e81-9fa8-469a4a64b147", "row_index": 261, "timestamp": "2017-02-27T20:09:05Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1479, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4efdc38c-7d18-4e81-9fa8-469a4a64b147", "eventTime": "2017-02-27T20:09:05Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA86SLAF6Q7X9IL1H9", "expiration": "Feb 28, 2017 2:19:34 AM", "sessionToken": "FQoDYXdzEE0aDCIFj9cRZFLt9FaL5SK3A41aJ3raQKRHD3SoOtYGm1Nk0I2bzRjqpKTp6hsgcO9fcA3ai58VqcsW852MrSoV64OiIZ+AI+uP88rWbmH1QbSJ/Hxy4QkWr+dR3zGml0Xaoscm3SgqPcnlg8DmeeHiXPZ2Uum9TpMsWp6NFWb6rIQn34WJCNutpEFmS8UwD6yfX3ZNA5HAXzozsW1/QpId6LywhPGdPaiBuckHkUlAsM4E1FMszsjgBNkawTaFxQ8Y27o6I8j7J7XKP07yigIdETBmm6Axvcn0+JR+9Xi5mCJHr1AWq8LfGKYQSQVdRwjQ+6rqP/zcVkQ9MW8vYuMS0hBeSV5jsZeR3Wv+RJ8E5etREeWyAipvWI/d2lGgVbbmn/F0SYRvFWZ/DCSYhR+3UOAbfNoXDmWyZrtCbN29RLJcMSiGrMemmiv1NgW1bCUJC9FKl9J0Obse4SJtjLbzBhW9VUl0UyYqEy3FcUz/XTKoXdceiULtY9upGT14OgbeHfeVG/9pehltefizmD3Tw+oO31EpKkbM9gmweAgv6kzi0oDB9IObGhtmc6uOlpHl4ADcdKfqDUMjJCWGipE/UGC8RmuHrlco4Y7SxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "37995a2-0aa0-4da2-b1d9-f587a4a2cf98", "record_id": "flaws_cloudtrail:0000262:37995a2-0aa0-4da2-b1d9-f587a4a2cf98", "row_index": 262, "timestamp": "2017-02-27T20:18:48Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "162.255.129.1", "user_agent": "[aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41]", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 643, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "37995a2-0aa0-4da2-b1d9-f587a4a2cf98", "eventTime": "2017-02-27T20:18:48Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "162.255.129.1", "userAgent": "[aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41]", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "931edd2b-7f1a-4332-ae97-91f3d66e0c4b", "record_id": "flaws_cloudtrail:0000263:931edd2b-7f1a-4332-ae97-91f3d66e0c4b", "row_index": 263, "timestamp": "2017-02-27T20:19:15Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "162.255.129.1", "user_agent": "[aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41]", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 639, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "931edd2b-7f1a-4332-ae97-91f3d66e0c4b", "eventTime": "2017-02-27T20:19:15Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "162.255.129.1", "userAgent": "[aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41]", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a1cbf839-4db4-49df-b826-84261c9081a", "record_id": "flaws_cloudtrail:0000264:a1cbf839-4db4-49df-b826-84261c9081a", "row_index": 264, "timestamp": "2017-02-27T20:19:22Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.203.251.64", "user_agent": "aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 708, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a1cbf839-4db4-49df-b826-84261c9081a", "eventTime": "2017-02-27T20:19:22Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.203.251.64", "userAgent": "aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "66d96478-8aa7-4a84-ad0e-366b3409f27e", "record_id": "flaws_cloudtrail:0000265:66d96478-8aa7-4a84-ad0e-366b3409f27e", "row_index": 265, "timestamp": "2017-02-27T20:22:06Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "109.141.221.4", "user_agent": "[aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 648, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "66d96478-8aa7-4a84-ad0e-366b3409f27e", "eventTime": "2017-02-27T20:22:06Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "109.141.221.4", "userAgent": "[aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bbefcd3c-f7d5-47c1-b91e-417121d97d2c", "record_id": "flaws_cloudtrail:0000266:bbefcd3c-f7d5-47c1-b91e-417121d97d2c", "row_index": 266, "timestamp": "2017-02-27T20:22:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.203.251.64", "user_agent": "aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 764, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bbefcd3c-f7d5-47c1-b91e-417121d97d2c", "eventTime": "2017-02-27T20:22:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.203.251.64", "userAgent": "aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "121af6cc-0b6a-4976-ae89-14ee443c9743", "record_id": "flaws_cloudtrail:0000267:121af6cc-0b6a-4976-ae89-14ee443c9743", "row_index": 267, "timestamp": "2017-02-27T20:22:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.203.251.64", "user_agent": "aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "121af6cc-0b6a-4976-ae89-14ee443c9743", "eventTime": "2017-02-27T20:22:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.203.251.64", "userAgent": "aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJVQ2d5MnZFamJyODhqbUxnVHhuZXUyRmZaUW80VDgrZitML0djcnhDaDlVQjZuamJ1aTdsWkE2ZkdOeUJ3eERmdkwycVhmajEweHp3a3BycnlBdzE1YkZoTjRpODJRaHZZN0FwOXllKzNLU3FUdlRtMFlta3JVeDMrdENyVk1tZ0ZIalhnL245Mm9OT3hFbllWcjFyQWc9PSIsImkiOiJzYVBMQU1wTkg5bWRyanVPS2dlM3Z3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8d951003f-e2af-4f5f-97ee-1cc5c4284ca7", "record_id": "flaws_cloudtrail:0000268:8d951003f-e2af-4f5f-97ee-1cc5c4284ca7", "row_index": 268, "timestamp": "2017-02-27T20:22:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.203.251.64", "user_agent": "aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1056, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8d951003f-e2af-4f5f-97ee-1cc5c4284ca7", "eventTime": "2017-02-27T20:22:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.203.251.64", "userAgent": "aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJCbGpKQ3NXRzRYZ0hkazYwcGlFMHNROXRGZlZQRnVZbUcrTEYrU0VmbXlROWJkR3NuZ0M2eW9sSFB3Q0lyQUNxOXpHdHAvdkN6eFE3VXVlOVZhQXFIUkg3aE5IWXBmaU5nS1gzZ1p6ZHVPenEzV2VtNWVVSG5IeFphdm9XMjBJb3dJa2hDMEU4cTBMOGVhaHh1U05WTlE9PSIsImkiOiJiNldOUXova2pSMmk3WVZMd0Y5Q2RBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "edd97ce5-df63-45a6-97df-0727ecf2b44a", "record_id": "flaws_cloudtrail:0000269:edd97ce5-df63-45a6-97df-0727ecf2b44a", "row_index": 269, "timestamp": "2017-02-27T20:22:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.203.251.64", "user_agent": "aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "edd97ce5-df63-45a6-97df-0727ecf2b44a", "eventTime": "2017-02-27T20:22:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.203.251.64", "userAgent": "aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJPbHJvQTN4eDdoSEZUU3JzQlpMc0lzSUJMTnVZVjlLNytIVUpZZkJKRWFmUjFJRkpMK0VQOFkwMEFtZUVyaVk3ZHJnVkk1WDBCVkJaTGpqelc5dDVWUWtHZjhlaC81VzZGdlFmMjNOYklKeTJ4SzhTZ3hmb20ycmxHMUQ2QStNQnRtcW1sTnYwcHNoakYyckJxUjJ5V3c9PSIsImkiOiIvaUxlMCtXckxnYjJuY3RVWmFPcWZBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "489947fec-59b6-4afd-9e59-b3022c0719fe", "record_id": "flaws_cloudtrail:0000270:489947fec-59b6-4afd-9e59-b3022c0719fe", "row_index": 270, "timestamp": "2017-02-27T20:22:27Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.203.251.64", "user_agent": "aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1056, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "489947fec-59b6-4afd-9e59-b3022c0719fe", "eventTime": "2017-02-27T20:22:27Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.203.251.64", "userAgent": "aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJneHJDTStkZGNBSzlUMStLTzJiOUM0WUFEbCtJSDVlTmo1UXNDNDdkeURScDI4M0NCWHNhRlZvaG1Ubm9qYVJVeWd0SDdsN1FpdWNXTSs0TXhSY3JrNzM2WnAxRWt0SHRMcjhLR21oYVBXYzRYNWN5bm5iY1JBVnd3am0wSUxacTgrcUxPeW1SSXUwL2xJRHJMYWFzb3c9PSIsImkiOiI3RHRmRHd3NE8vK294SHlaaHpTVDhnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5f55c5ae-fc79-4e9d-b68e-ec28c551b102", "record_id": "flaws_cloudtrail:0000271:5f55c5ae-fc79-4e9d-b68e-ec28c551b102", "row_index": 271, "timestamp": "2017-02-27T20:22:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.203.251.64", "user_agent": "aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5f55c5ae-fc79-4e9d-b68e-ec28c551b102", "eventTime": "2017-02-27T20:22:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.203.251.64", "userAgent": "aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJxZlJ2dWFKVjVWK0hpRlVnYm4zRnR4UDZnc0NiSmxsajhBYTMrTGxLWHdxN2hiajlTMFVXUXZKY09sdHNuejhrWndaWTZtaW9wa2t1TzIweHFxbVRRQnJhTEYwSEtzWC9RWFpnNzNMVzMzTjJac3lIUHppYU1kRUV3b1hmUENOQ2RsYzYrMndyYTQyWi96N0xBS3piV0E9PSIsImkiOiJuYjd0WUpGeURRNWEwQmhXa0VHNjRBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8614d3a6-ece8-4835-81fd-a31e1ce929e0", "record_id": "flaws_cloudtrail:0000272:8614d3a6-ece8-4835-81fd-a31e1ce929e0", "row_index": 272, "timestamp": "2017-02-27T20:22:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.203.251.64", "user_agent": "aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8614d3a6-ece8-4835-81fd-a31e1ce929e0", "eventTime": "2017-02-27T20:22:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.203.251.64", "userAgent": "aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJzK0s2RGZ0RG1RczBRVHFGVW1nQmNhdWdwcWxOa0R3eUxDd0JNTjZrc1VmbFFSY2lhSDhDZnkrYkdCMnh5Qm5yUitCMDVRMDQ3WWpiMTY0S1haUmFtQWt0OW43SVhHNDVRUnpwSjZTbWlBUVcvNUtSYlkyRnVGTU5PSEpZMWZBL0NnWXl4TTNjNVNNV2UwQTlFTVl1SGc9PSIsImkiOiJEWXB1enFuekpJWDJYeEJtWTBtVHh3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8b747310e-fb07-4465-b0c4-62950e65d63", "record_id": "flaws_cloudtrail:0000273:8b747310e-fb07-4465-b0c4-62950e65d63", "row_index": 273, "timestamp": "2017-02-27T20:22:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.203.251.64", "user_agent": "aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8b747310e-fb07-4465-b0c4-62950e65d63", "eventTime": "2017-02-27T20:22:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.203.251.64", "userAgent": "aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJxSjBNNGxwRVVTTTNWY0d0amVTNFhwd1QwemJmeUM3MUpwZm5EcXIxVngzLythMzJMaERFRmJNOVJnN0tqNnhyUXpIL1M0ZGxMVDhjSUFsS245emg4R3FXZHFWdDIyTXlNWTM1d0V3WUowOUhzVzMxWXdrMVdtSll4TVE3ZmNtbXZhaVZsRWRRRjhTeHVOdjNkK29Ramc9PSIsImkiOiJBUHhWa0JmSFhwRlBJVmo2RW14T3h3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "203a6b68-5545-4c2d-b2d4-a8cfa5bb2ba0", "record_id": "flaws_cloudtrail:0000274:203a6b68-5545-4c2d-b2d4-a8cfa5bb2ba0", "row_index": 274, "timestamp": "2017-02-27T20:23:51Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.203.251.64", "user_agent": "aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 790, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "203a6b68-5545-4c2d-b2d4-a8cfa5bb2ba0", "eventTime": "2017-02-27T20:23:51Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.203.251.64", "userAgent": "aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "self"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0e6a71c2-c62f-40fc-9f44-64027f0ea", "record_id": "flaws_cloudtrail:0000275:0e6a71c2-c62f-40fc-9f44-64027f0ea", "row_index": 275, "timestamp": "2017-02-27T20:25:13Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "252.6.5.4", "user_agent": "[aws-cli/1.10.17 Python/2.7.12 Darwin/16.4.0 botocore/1.4.8]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 629, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0e6a71c2-c62f-40fc-9f44-64027f0ea", "eventTime": "2017-02-27T20:25:13Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "252.6.5.4", "userAgent": "[aws-cli/1.10.17 Python/2.7.12 Darwin/16.4.0 botocore/1.4.8]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bd117e09-c196-4601-aa59-db8674b8931a", "record_id": "flaws_cloudtrail:0000276:bd117e09-c196-4601-aa59-db8674b8931a", "row_index": 276, "timestamp": "2017-02-27T20:26:49Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "252.6.5.4", "user_agent": "aws-cli/1.10.17 Python/2.7.12 Darwin/16.4.0 botocore/1.4.8", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 727, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bd117e09-c196-4601-aa59-db8674b8931a", "eventTime": "2017-02-27T20:26:49Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "252.6.5.4", "userAgent": "aws-cli/1.10.17 Python/2.7.12 Darwin/16.4.0 botocore/1.4.8", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "862ddc0c-729b-4066-9e7d-62a4dbe5237b", "record_id": "flaws_cloudtrail:0000277:862ddc0c-729b-4066-9e7d-62a4dbe5237b", "row_index": 277, "timestamp": "2017-02-27T20:27:20Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "162.255.129.1", "user_agent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 769, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "862ddc0c-729b-4066-9e7d-62a4dbe5237b", "eventTime": "2017-02-27T20:27:20Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "162.255.129.1", "userAgent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6a817bc1-bda9-452c-9598-c60385e", "record_id": "flaws_cloudtrail:0000278:6a817bc1-bda9-452c-9598-c60385e", "row_index": 278, "timestamp": "2017-02-27T20:28:24Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "162.255.129.1", "user_agent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 761, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6a817bc1-bda9-452c-9598-c60385e", "eventTime": "2017-02-27T20:28:24Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "162.255.129.1", "userAgent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f4ac8bb7-0d57-4ce7-84a2-917cb7e2d670", "record_id": "flaws_cloudtrail:0000279:f4ac8bb7-0d57-4ce7-84a2-917cb7e2d670", "row_index": 279, "timestamp": "2017-02-27T20:28:25Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "252.6.5.4", "user_agent": "aws-cli/1.10.17 Python/2.7.12 Darwin/16.4.0 botocore/1.4.8", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 693, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f4ac8bb7-0d57-4ce7-84a2-917cb7e2d670", "eventTime": "2017-02-27T20:28:25Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "252.6.5.4", "userAgent": "aws-cli/1.10.17 Python/2.7.12 Darwin/16.4.0 botocore/1.4.8", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ceb0be76-8158-49b2-9781-3c851f950199c", "record_id": "flaws_cloudtrail:0000280:ceb0be76-8158-49b2-9781-3c851f950199c", "row_index": 280, "timestamp": "2017-02-27T20:28:36Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "252.6.5.4", "user_agent": "aws-cli/1.10.17 Python/2.7.12 Darwin/16.4.0 botocore/1.4.8", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ceb0be76-8158-49b2-9781-3c851f950199c", "eventTime": "2017-02-27T20:28:36Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "252.6.5.4", "userAgent": "aws-cli/1.10.17 Python/2.7.12 Darwin/16.4.0 botocore/1.4.8", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6e70c6d9-b879-44e2-a1b2-234e1deb0263", "record_id": "flaws_cloudtrail:0000281:6e70c6d9-b879-44e2-a1b2-234e1deb0263", "row_index": 281, "timestamp": "2017-02-27T20:29:16Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "109.141.221.4", "user_agent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 702, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6e70c6d9-b879-44e2-a1b2-234e1deb0263", "eventTime": "2017-02-27T20:29:16Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "109.141.221.4", "userAgent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5a19be1b-f9d0-4fbf-848e-25e5804ae96d", "record_id": "flaws_cloudtrail:0000282:5a19be1b-f9d0-4fbf-848e-25e5804ae96d", "row_index": 282, "timestamp": "2017-02-27T20:29:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "162.255.129.1", "user_agent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 766, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5a19be1b-f9d0-4fbf-848e-25e5804ae96d", "eventTime": "2017-02-27T20:29:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "162.255.129.1", "userAgent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f4dff209-9467-41ff-ae19-b10651d26e7", "record_id": "flaws_cloudtrail:0000283:f4dff209-9467-41ff-ae19-b10651d26e7", "row_index": 283, "timestamp": "2017-02-27T20:29:38Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "109.141.221.4", "user_agent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 732, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f4dff209-9467-41ff-ae19-b10651d26e7", "eventTime": "2017-02-27T20:29:38Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "109.141.221.4", "userAgent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a4e015e4-75c8-42fd-a99c-d37cf8b034eb", "record_id": "flaws_cloudtrail:0000284:a4e015e4-75c8-42fd-a99c-d37cf8b034eb", "row_index": 284, "timestamp": "2017-02-27T20:29:39Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.203.251.64", "user_agent": "aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a4e015e4-75c8-42fd-a99c-d37cf8b034eb", "eventTime": "2017-02-27T20:29:39Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.203.251.64", "userAgent": "aws-cli/1.11.55 Python/2.7.9 Linux/4.8.6-x86_64-linode78 botocore/1.5.18", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "754b982c-b600-4b5f-bef1-4e1e9a8d3688", "record_id": "flaws_cloudtrail:0000285:754b982c-b600-4b5f-bef1-4e1e9a8d3688", "row_index": 285, "timestamp": "2017-02-27T20:31:09Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAN4AJ104O9WZVZBR9", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "117.30.4.57", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1028, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "754b982c-b600-4b5f-bef1-4e1e9a8d3688", "eventTime": "2017-02-27T20:31:09Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "117.30.4.57", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAN4AJ104O9WZVZBR9", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-02-27T19:19:05Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logGroupName": "/aws/lambda/Level6", "logStreamName": "2017/02/27/[$LATEST]5a851c89d8f148e82e8ee37444727929"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7aac4b48-8f90-4f4b-aa48-ac7bf60e6ea9", "record_id": "flaws_cloudtrail:0000286:7aac4b48-8f90-4f4b-aa48-ac7bf60e6ea9", "row_index": 286, "timestamp": "2017-02-27T20:31:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "109.141.221.4", "user_agent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 754, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7aac4b48-8f90-4f4b-aa48-ac7bf60e6ea9", "eventTime": "2017-02-27T20:31:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "109.141.221.4", "userAgent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b44208-37a5-4f99-98ff-25797854f427", "record_id": "flaws_cloudtrail:0000287:b44208-37a5-4f99-98ff-25797854f427", "row_index": 287, "timestamp": "2017-02-27T20:31:27Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "109.141.221.4", "user_agent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1041, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b44208-37a5-4f99-98ff-25797854f427", "eventTime": "2017-02-27T20:31:27Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "109.141.221.4", "userAgent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJrblhjZ2RFY2src1NTTUlSZkpkM0NnNllvL3VIWmpxZzMwWG4wWGlaV3VYcnFhR1RvQUZreHBoS21FU0YvaEZYeTl4WEdYSGNLVEVPVHY3b1J5TlI1UXpFaCtqdW00SUgxeEpKVG1QU0JqUXFsRHFtdG1sK2U5c3pydFJYRnhMOHkrQXJaNWxnMHQrOXFlTXg4Vm9JV2c9PSIsImkiOiIrckZVS2MrUUZYeTVrbzhDNTZER1hBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac7f769a-0b49-4006-950d-bb885469edda", "record_id": "flaws_cloudtrail:0000288:ac7f769a-0b49-4006-950d-bb885469edda", "row_index": 288, "timestamp": "2017-02-27T20:31:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "109.141.221.4", "user_agent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac7f769a-0b49-4006-950d-bb885469edda", "eventTime": "2017-02-27T20:31:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "109.141.221.4", "userAgent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJvRUFyRW5BYnBEcG5lNVdsRlBMSXJHTUZiSFRSeHV5UTZiQ3dDQ0tLaDJDdFRVMVl3MEFBbEVDYlJMZmgydGRiT3JhZXFPMDRnd3ZDZmxNaTZMSUhBcThjWi9YSWpad0I2RytHczhtbU9GVEc0aFZ3UlJkZ25QOU5WVkRrbjRldjVnU0ZmbnB2Q1hmdHlrNDJ6bERvamc9PSIsImkiOiJHR3BSMHkwQ2pqTHlZam9VcHBCanpRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9a1518d8-49b4-49ed-9d8a-cce7af33a18f", "record_id": "flaws_cloudtrail:0000289:9a1518d8-49b4-49ed-9d8a-cce7af33a18f", "row_index": 289, "timestamp": "2017-02-27T20:31:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "109.141.221.4", "user_agent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1045, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9a1518d8-49b4-49ed-9d8a-cce7af33a18f", "eventTime": "2017-02-27T20:31:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "109.141.221.4", "userAgent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJ3U1QvZWZwQ3pDc0hvTnJ5TmtsMGtUclM0bFhRcU1jdmIrNzU3Q3JYYUJXU0lrTVRLOWRpRXFIWWhWZWRVNk8yazNSZHluMVZqeWlYOS9sUUdWdTJpTUgrOVkyN09rVzJWWFJyNCtobGVCK2p2K0FSYmR0NGI1N2lPQjBveTRkempicklJQjB3cHNQMi9HZlJXS1BHYWc9PSIsImkiOiIxRXJBdUNvN3VqZUlYd1N0ZklCUjdBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "627311d-457d-49f2-8c9c-cd71fd037cb7", "record_id": "flaws_cloudtrail:0000290:627311d-457d-49f2-8c9c-cd71fd037cb7", "row_index": 290, "timestamp": "2017-02-27T20:31:48Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "109.141.221.4", "user_agent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1045, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "627311d-457d-49f2-8c9c-cd71fd037cb7", "eventTime": "2017-02-27T20:31:48Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "109.141.221.4", "userAgent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiIrVG51ZXl1S1NPakJ4SnNwcnoyRW94QmlOb0d1NWRVWldYVkROdW1ZTlk3c3pFazFzTXRNejFmejVxWVd1Sjl6K0RKbEY3MUFRa2FLWEhWd0REdkozL3BTM2NWQ1BLbHFrTGVjaW5DNjU3Ti80ZnlqRXpFMkZLN1hBZzYxZloyNmdpeURBVXVLUTNjOTJxUzc2VVIrUEE9PSIsImkiOiJLb1BiVXNNZy9uV2pVYktTbDQ5ZE1nPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7f051aee-46c9-4442-ba00-0ddd22a11b57", "record_id": "flaws_cloudtrail:0000291:7f051aee-46c9-4442-ba00-0ddd22a11b57", "row_index": 291, "timestamp": "2017-02-27T20:32:00Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "109.141.221.4", "user_agent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7f051aee-46c9-4442-ba00-0ddd22a11b57", "eventTime": "2017-02-27T20:32:00Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "109.141.221.4", "userAgent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiIwbFNyMWEvQjBsV3ErclhiMXFzd2duL0RWODJJUkg1dUFyRTZLeHlIQnhPU1JDNEp1dHlzMlRmQXIwRi84UjZMRGw2VVVtSW9uUmNtOW9PdGU1dVF0djJzVXphcHRTWkRVRTMrL1RzMVhkZkVZVGpjcjJ6ZWwwZUpudm1sdUg5QVZwa3pyWU1BbnpBNVdjN2JZd3N3WFE9PSIsImkiOiIvdjhaMko2WnVCU1NuTTZldWlib09nPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7683a7d3-4064-48f9-8d79-ba1de82bb8b8", "record_id": "flaws_cloudtrail:0000292:7683a7d3-4064-48f9-8d79-ba1de82bb8b8", "row_index": 292, "timestamp": "2017-02-27T20:32:10Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "109.141.221.4", "user_agent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7683a7d3-4064-48f9-8d79-ba1de82bb8b8", "eventTime": "2017-02-27T20:32:10Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "109.141.221.4", "userAgent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJ5MG44bUFHRjl5ZWJ3YzNpVk1tcGJZZEUvbHdIRGFQbWIwdk9McU4zcFZxZFQ3NHh3WW1GR0J6eTNNM1cyZDlrYWZ1b2dlMjFLWnZjTEFURHdlbys1blJiV1M2QzhBR1lJV3BEeXdHWnExcEdab0dLbEFUQXdYQ3E3bHNXemcvSHV0c1dHbHI5S09PVmVWVWhPcjd2NVE9PSIsImkiOiIvL05GcDBpdFNlTlpGVjVzVkp6OExBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "17c42c34-e9cc-4057-8f22-66c5bf62b31e", "record_id": "flaws_cloudtrail:0000293:17c42c34-e9cc-4057-8f22-66c5bf62b31e", "row_index": 293, "timestamp": "2017-02-27T20:32:17Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "109.141.221.4", "user_agent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1046, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "17c42c34-e9cc-4057-8f22-66c5bf62b31e", "eventTime": "2017-02-27T20:32:17Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "109.141.221.4", "userAgent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJsUDZ5eFd6amRDcVJFKzZRaFFaNXR3ZkowN0dzUUpVREpBc09pcDNLNFg4MnpjVW44anNyRXI4ZDNnK2xVS1NtOC9Ub0VGOCthZkFpSi9zRVpFa29MV2ozcE1ZS2xVYmc1aXhzcGFzTUZQQjZUTS85aEwyRVFybmJpTVRGOW5NendkdHdCeGYvdFB3dzJ5RjVOMUFNOXc9PSIsImkiOiJvQjZaTitMd1lWSHZqd0g2eE9UZTJnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f7a0c67e-642f-4a47-b21a-590983a0bece", "record_id": "flaws_cloudtrail:0000294:f7a0c67e-642f-4a47-b21a-590983a0bece", "row_index": 294, "timestamp": "2017-02-27T20:34:56Z", "event_type": "CopySnapshot", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "109.141.221.4", "user_agent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1323, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f7a0c67e-642f-4a47-b21a-590983a0bece", "eventTime": "2017-02-27T20:34:56Z", "eventName": "CopySnapshot", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "109.141.221.4", "userAgent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"sourceRegion": "eu-west-1", "sourceSnapshotId": "snap-4fd281251b99202a3", "destinationRegion": "us-west-2", "presignedUrl": "https://ec2.eu-west-1.amazonaws.com/?Action=CopySnapshot&Version=2016-11-15&SourceRegion=eu-west-1&SourceSnapshotId=snap-4fd281251b99202a3&DestinationRegion=us-west-2&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIA1ZBTOEKWKVHP6GHZ%2F172111%2Feu-west-1%2Fec2%2Faws4_request&X-Amz-Date=172111T71232Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=1e6bf02d687ef29f177704a9c4ed4d88b1084dffeb7bfdbbcd2087eaeb576e82"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fbca432e-43eb-4f75-81db-d22362cee79c", "record_id": "flaws_cloudtrail:0000295:fbca432e-43eb-4f75-81db-d22362cee79c", "row_index": 295, "timestamp": "2017-02-27T20:35:03Z", "event_type": "CopySnapshot", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "109.141.221.4", "user_agent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1323, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fbca432e-43eb-4f75-81db-d22362cee79c", "eventTime": "2017-02-27T20:35:03Z", "eventName": "CopySnapshot", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "109.141.221.4", "userAgent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"sourceRegion": "us-west-1", "sourceSnapshotId": "snap-4fd281251b99202a3", "destinationRegion": "us-west-2", "presignedUrl": "https://ec2.us-west-1.amazonaws.com/?Action=CopySnapshot&Version=2016-11-15&SourceRegion=us-west-1&SourceSnapshotId=snap-4fd281251b99202a3&DestinationRegion=us-west-2&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIA1ZBTOEKWKVHP6GHZ%2F172111%2Fus-west-1%2Fec2%2Faws4_request&X-Amz-Date=172111T091662Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=e91e44595667717aefe25d7938e4c4df8e0e290bec538760c764c1b3728908f1"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e0e296e9-4641-4a10-8c68-fbe5458e6fba", "record_id": "flaws_cloudtrail:0000296:e0e296e9-4641-4a10-8c68-fbe5458e6fba", "row_index": 296, "timestamp": "2017-02-27T20:35:36Z", "event_type": "CopySnapshot", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "109.141.221.4", "user_agent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1326, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e0e296e9-4641-4a10-8c68-fbe5458e6fba", "eventTime": "2017-02-27T20:35:36Z", "eventName": "CopySnapshot", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "109.141.221.4", "userAgent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"sourceRegion": "us-west-2", "sourceSnapshotId": "snap-4fd281251b99202a3", "destinationRegion": "us-west-2", "presignedUrl": "https://ec2.us-west-2.amazonaws.com/?Action=CopySnapshot&Version=2016-11-15&SourceRegion=us-west-2&SourceSnapshotId=snap-4fd281251b99202a3&DestinationRegion=us-west-2&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIA1ZBTOEKWKVHP6GHZ%2F172111%2Fus-west-2%2Fec2%2Faws4_request&X-Amz-Date=172111T319435Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=3b8d9ba3267e788b476f4289c6a6a6ec56550ef4967558442ccd98551625c63c"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "904991c22-b78d-4b11-8a01-1c178245c", "record_id": "flaws_cloudtrail:0000297:904991c22-b78d-4b11-8a01-1c178245c", "row_index": 297, "timestamp": "2017-02-27T20:35:57Z", "event_type": "CopySnapshot", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "109.141.221.4", "user_agent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1324, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "904991c22-b78d-4b11-8a01-1c178245c", "eventTime": "2017-02-27T20:35:57Z", "eventName": "CopySnapshot", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "109.141.221.4", "userAgent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"sourceRegion": "us-west-2", "sourceSnapshotId": "snap-4fd281251b99202a3", "destinationRegion": "us-west-2", "presignedUrl": "https://ec2.us-west-2.amazonaws.com/?Action=CopySnapshot&Version=2016-11-15&SourceRegion=us-west-2&SourceSnapshotId=snap-4fd281251b99202a3&DestinationRegion=us-west-2&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIA1ZBTOEKWKVHP6GHZ%2F172111%2Fus-west-2%2Fec2%2Faws4_request&X-Amz-Date=172111T844398Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=7196b109085fcc1eee5ce23737138bb17ec5524900faf17d342f2570c8dc3840"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d851490e-6c4d-4613-98b3-57af48624", "record_id": "flaws_cloudtrail:0000298:d851490e-6c4d-4613-98b3-57af48624", "row_index": 298, "timestamp": "2017-02-27T20:37:39Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "62.4.254.56", "user_agent": "[aws-cli/1.11.51 Python/3.4.3 Linux/3.13.0-108-generic botocore/1.5.14]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 647, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d851490e-6c4d-4613-98b3-57af48624", "eventTime": "2017-02-27T20:37:39Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "62.4.254.56", "userAgent": "[aws-cli/1.11.51 Python/3.4.3 Linux/3.13.0-108-generic botocore/1.5.14]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d0b4eaa9-156c-466e-9071-c0f9d452cf2c", "record_id": "flaws_cloudtrail:0000299:d0b4eaa9-156c-466e-9071-c0f9d452cf2c", "row_index": 299, "timestamp": "2017-02-27T20:37:59Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "[aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 642, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d0b4eaa9-156c-466e-9071-c0f9d452cf2c", "eventTime": "2017-02-27T20:37:59Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "[aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "176638-ef35-4157-a8d6-5fc7c4d15bd4", "record_id": "flaws_cloudtrail:0000300:176638-ef35-4157-a8d6-5fc7c4d15bd4", "row_index": 300, "timestamp": "2017-02-27T20:42:01Z", "event_type": "CopySnapshot", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "109.141.221.4", "user_agent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1319, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "176638-ef35-4157-a8d6-5fc7c4d15bd4", "eventTime": "2017-02-27T20:42:01Z", "eventName": "CopySnapshot", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "109.141.221.4", "userAgent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"sourceRegion": "us-west-2", "sourceSnapshotId": "snap-4fd281251b99202a3", "destinationRegion": "us-west-2", "presignedUrl": "https://ec2.us-west-2.amazonaws.com/?Action=CopySnapshot&Version=2016-11-15&SourceRegion=us-west-2&SourceSnapshotId=snap-4fd281251b99202a3&DestinationRegion=us-west-2&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIA1ZBTOEKWKVHP6GHZ%2F172111%2Fus-west-2%2Fec2%2Faws4_request&X-Amz-Date=172111T151660Z&X-Amz-Expires=3600&X-Amz-SignedHeaders=host&X-Amz-Signature=ad5b5f03feb45fd591e8f6165e32ab09c2c4411274c031598da0befdd41329d8"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6b47144-61c1-4330-9da3-a251756ca104", "record_id": "flaws_cloudtrail:0000301:6b47144-61c1-4330-9da3-a251756ca104", "row_index": 301, "timestamp": "2017-02-27T20:42:12Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "109.141.221.4", "user_agent": "[aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 648, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6b47144-61c1-4330-9da3-a251756ca104", "eventTime": "2017-02-27T20:42:12Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "109.141.221.4", "userAgent": "[aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0b206a0a-f567-4227-9ee4-4a8ffa84d1cb", "record_id": "flaws_cloudtrail:0000302:0b206a0a-f567-4227-9ee4-4a8ffa84d1cb", "row_index": 302, "timestamp": "2017-02-27T20:42:37Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "162.255.129.1", "user_agent": "[aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41]", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 643, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0b206a0a-f567-4227-9ee4-4a8ffa84d1cb", "eventTime": "2017-02-27T20:42:37Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "162.255.129.1", "userAgent": "[aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41]", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "97e18c34-3353-4162-8df8-532c597482f7", "record_id": "flaws_cloudtrail:0000303:97e18c34-3353-4162-8df8-532c597482f7", "row_index": 303, "timestamp": "2017-02-27T20:47:28Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "109.141.221.4", "user_agent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 786, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "97e18c34-3353-4162-8df8-532c597482f7", "eventTime": "2017-02-27T20:47:28Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "109.141.221.4", "userAgent": "aws-cli/1.11.55 Python/3.6.0 Linux/4.9.11-1-ARCH botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"snapshotSet": {"items": [{"snapshotId": "snap-4fd281251b99202a3"}]}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6af12e75-2d15-46cd-962f-023965354f48", "record_id": "flaws_cloudtrail:0000304:6af12e75-2d15-46cd-962f-023965354f48", "row_index": 304, "timestamp": "2017-02-27T20:51:50Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 770, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6af12e75-2d15-46cd-962f-023965354f48", "eventTime": "2017-02-27T20:51:50Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7a28a62a-5147-435d-aa75-cb1b8e34731", "record_id": "flaws_cloudtrail:0000305:7a28a62a-5147-435d-aa75-cb1b8e34731", "row_index": 305, "timestamp": "2017-02-27T20:57:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7a28a62a-5147-435d-aa75-cb1b8e34731", "eventTime": "2017-02-27T20:57:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "22c875ef-ee58-42a3-b0bf-a3c907b8ca39", "record_id": "flaws_cloudtrail:0000306:22c875ef-ee58-42a3-b0bf-a3c907b8ca39", "row_index": 306, "timestamp": "2017-02-27T20:57:05Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1042, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "22c875ef-ee58-42a3-b0bf-a3c907b8ca39", "eventTime": "2017-02-27T20:57:05Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJYUWI0MzF4ZE41TXlHZkZGTFBsaTRFYTZEQzM4dHR1cE55WjNabG5EbFNadFlGeUxlbDU4eG4vSjVRTWRlMWViVjRqRGNib1hyNUZ1c0FBdi9BRFBTWjFEWTV6Z0E5RTYrRnJGQjRnY0F6YXhmNWRkNytmcXlvblc1TE55YmtvNlZ6c2M3dVQvUWtaV2o3YUM2OUt5MEE9PSIsImkiOiJtdjhZdHdZMTlWb0ZPMWdrbkV4QzdRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9d49de8f-9171-414d-9e25-8b84514b16b1", "record_id": "flaws_cloudtrail:0000307:9d49de8f-9171-414d-9e25-8b84514b16b1", "row_index": 307, "timestamp": "2017-02-27T20:57:07Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1042, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9d49de8f-9171-414d-9e25-8b84514b16b1", "eventTime": "2017-02-27T20:57:07Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJpUmNPMG9HeTBkSktSOHlOenFUdm5MUm1lUHFyYTFXa3JnS3R1OFVveGsrSExic0RxYVlGb0RaTjgrRmxuQnZUMTJQbTFjTU9sdExQK092d094VGtyRDZ2eGZiTndwd0VVYS92UHB2bUNFVGt1NUhQQU1yb0h3TTZzMW9zeGhxeGdZbTJGZ3Y5dUJFUHhTSThBU09heGc9PSIsImkiOiI0TGwvaGVyMWxwMWoxVjhON3hCQTNRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9c2c0f06-cafd-45a2-ba62-e50f0b9f1dd7", "record_id": "flaws_cloudtrail:0000308:9c2c0f06-cafd-45a2-ba62-e50f0b9f1dd7", "row_index": 308, "timestamp": "2017-02-27T20:57:09Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1039, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9c2c0f06-cafd-45a2-ba62-e50f0b9f1dd7", "eventTime": "2017-02-27T20:57:09Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJ5bDdIWW8zalpVR3Rmb01LK1BhYTJZQ29uMDE1eHQzZVpQSXd1RmpsbXdGT3ZpYW9xL2JqaDZ2d2FwdzJoa0xiTmxrclVVdkpaREV6Y1RyODhMdjUxQkVHYmg1Uy9QZE5yTkYxZm00cExmV0h2cmtDSzM4UVNxd0VubkhJb1BoQjhMMmZMb0FiK3pWeUE4T24zaFpvZ3c9PSIsImkiOiI2MHN1TzhYaXQrS3NEdkN2VHpPRXVnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a94539b4-85b4-463e-a2a2-610946fd1c8d4", "record_id": "flaws_cloudtrail:0000309:a94539b4-85b4-463e-a2a2-610946fd1c8d4", "row_index": 309, "timestamp": "2017-02-27T20:57:11Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1043, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a94539b4-85b4-463e-a2a2-610946fd1c8d4", "eventTime": "2017-02-27T20:57:11Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJITk5BeEgwQ1JoZnFzWnBoejFaeDl6bFV6eGkzNXA0YjJQeGdjMmt1ZVpJaVUveDE2UTkwa3NvSDNiN1NNNVduZWs2T1dBcVpidDBhWFUzbDY0YUpMNE1XbldLUzNibW4xcjZqRjZRazkvOTBnaVA5aWZnVk0rNitwRHJiRDZFZURrc0RGYVJHd0JQb1I3dHkrNDR0SlE9PSIsImkiOiI1aVRzdU5BMEo4SVRLVGVPMm9Vd0NBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d6cb7834-6f36-44c9-8a20-5b3c73a37e50", "record_id": "flaws_cloudtrail:0000310:d6cb7834-6f36-44c9-8a20-5b3c73a37e50", "row_index": 310, "timestamp": "2017-02-27T20:57:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1041, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d6cb7834-6f36-44c9-8a20-5b3c73a37e50", "eventTime": "2017-02-27T20:57:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJidWp2MFB5a0EvVVZmelVpRzlQejVNK1JwSzZjYjBOaVplV0FGb1d4SUE5dEM5MFpzNS9UdUUxTUZKcjduTXdJNW0wSjRUV3o0M2svcGhzc21FMGRSZklYamdLRlRoeWxJMUhHMFpzZ2IzckRrQitUNnE2UUVTMktXRFlTblpERC9zcHNGcnlMcjVhajBYbHBtbkg1TUE9PSIsImkiOiJMSlFYZm9NVUFzUzd1NGsvazVnekZRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "38d5b02d-49d8-450d-8b93-a89fca846967f", "record_id": "flaws_cloudtrail:0000311:38d5b02d-49d8-450d-8b93-a89fca846967f", "row_index": 311, "timestamp": "2017-02-27T20:57:26Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 771, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "38d5b02d-49d8-450d-8b93-a89fca846967f", "eventTime": "2017-02-27T20:57:26Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e418c441-da3e-4e78-a065-bf56a52b6836", "record_id": "flaws_cloudtrail:0000312:e418c441-da3e-4e78-a065-bf56a52b6836", "row_index": 312, "timestamp": "2017-02-27T20:57:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 899, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e418c441-da3e-4e78-a065-bf56a52b6836", "eventTime": "2017-02-27T20:57:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-west-2", "errorCode": "Client.InvalidUserID.Malformed", "errorMessage": "Invalid user id: \"AIDA9BO36HFBHKGJAO9C1\"", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "AIDA9BO36HFBHKGJAO9C1"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a77d72de-d16b-46f2-8d7d-f741e9996d16", "record_id": "flaws_cloudtrail:0000313:a77d72de-d16b-46f2-8d7d-f741e9996d16", "row_index": 313, "timestamp": "2017-02-27T20:57:49Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 899, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a77d72de-d16b-46f2-8d7d-f741e9996d16", "eventTime": "2017-02-27T20:57:49Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-west-2", "errorCode": "Client.InvalidUserID.Malformed", "errorMessage": "Invalid user id: \"AIDA9BO36HFBHKGJAO9C1\"", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "AIDA9BO36HFBHKGJAO9C1"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5c8fae67-3a02-497e-bc84-635ab9527ce6", "record_id": "flaws_cloudtrail:0000314:5c8fae67-3a02-497e-bc84-635ab9527ce6", "row_index": 314, "timestamp": "2017-02-27T20:58:06Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 785, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5c8fae67-3a02-497e-bc84-635ab9527ce6", "eventTime": "2017-02-27T20:58:06Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7f76f597-0042-4de3-80d7-3c65e32eb013", "record_id": "flaws_cloudtrail:0000315:7f76f597-0042-4de3-80d7-3c65e32eb013", "row_index": 315, "timestamp": "2017-02-27T20:58:35Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "162.255.129.1", "user_agent": "[aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41]", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 643, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7f76f597-0042-4de3-80d7-3c65e32eb013", "eventTime": "2017-02-27T20:58:35Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "162.255.129.1", "userAgent": "[aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41]", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6d80c9e7-2716-427f-ad8f-1d46ecf32e71", "record_id": "flaws_cloudtrail:0000316:6d80c9e7-2716-427f-ad8f-1d46ecf32e71", "row_index": 316, "timestamp": "2017-02-27T21:00:48Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 744, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6d80c9e7-2716-427f-ad8f-1d46ecf32e71", "eventTime": "2017-02-27T21:00:48Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-4fd281251b99202a3", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d324c364-2276-41ee-bacd-4f1df9b15e01", "record_id": "flaws_cloudtrail:0000317:d324c364-2276-41ee-bacd-4f1df9b15e01", "row_index": 317, "timestamp": "2017-02-27T21:00:56Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 755, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d324c364-2276-41ee-bacd-4f1df9b15e01", "eventTime": "2017-02-27T21:00:56Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-4fd281251b99202a3", "attributeType": "CREATE_VOLUME_PERMISSION"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ed71ccd5-5a8a-4c8a-98a2-73f62618f476", "record_id": "flaws_cloudtrail:0000318:ed71ccd5-5a8a-4c8a-98a2-73f62618f476", "row_index": 318, "timestamp": "2017-02-27T21:04:07Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 785, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ed71ccd5-5a8a-4c8a-98a2-73f62618f476", "eventTime": "2017-02-27T21:04:07Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3a94235-61c9-41f4-957b-a21cbfb76396", "record_id": "flaws_cloudtrail:0000319:3a94235-61c9-41f4-957b-a21cbfb76396", "row_index": 319, "timestamp": "2017-02-27T21:04:52Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3a94235-61c9-41f4-957b-a21cbfb76396", "eventTime": "2017-02-27T21:04:52Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"snapshotSet": {"items": [{"snapshotId": "snap-4fd281251b99202a3"}]}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fd2a0926-ca9d-4eaa-b451-4998bd01ebf8", "record_id": "flaws_cloudtrail:0000320:fd2a0926-ca9d-4eaa-b451-4998bd01ebf8", "row_index": 320, "timestamp": "2017-02-27T21:04:57Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "182.214.204.241", "user_agent": "[aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 655, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fd2a0926-ca9d-4eaa-b451-4998bd01ebf8", "eventTime": "2017-02-27T21:04:57Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "182.214.204.241", "userAgent": "[aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cb11cb1b-b51c-42e7-b33a-d7fbfc429207", "record_id": "flaws_cloudtrail:0000321:cb11cb1b-b51c-42e7-b33a-d7fbfc429207", "row_index": 321, "timestamp": "2017-02-27T21:05:06Z", "event_type": "GetAccountAuthorizationDetails", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "162.255.129.1", "user_agent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 681, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cb11cb1b-b51c-42e7-b33a-d7fbfc429207", "eventTime": "2017-02-27T21:05:06Z", "eventName": "GetAccountAuthorizationDetails", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "162.255.129.1", "userAgent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a3857abf-175c-4b20-be1f-3fb3b9061d36", "record_id": "flaws_cloudtrail:0000322:a3857abf-175c-4b20-be1f-3fb3b9061d36", "row_index": 322, "timestamp": "2017-02-27T21:06:06Z", "event_type": "GetAccountAuthorizationDetails", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "162.255.129.1", "user_agent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 680, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a3857abf-175c-4b20-be1f-3fb3b9061d36", "eventTime": "2017-02-27T21:06:06Z", "eventName": "GetAccountAuthorizationDetails", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "162.255.129.1", "userAgent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ad8ae7d9-b705-495b-b8e0-def9cbbaa69b", "record_id": "flaws_cloudtrail:0000323:ad8ae7d9-b705-495b-b8e0-def9cbbaa69b", "row_index": 323, "timestamp": "2017-02-27T21:09:27Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1478, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ad8ae7d9-b705-495b-b8e0-def9cbbaa69b", "eventTime": "2017-02-27T21:09:27Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIABWPVAN8HXQWFK998", "expiration": "Feb 28, 2017 3:18:22 AM", "sessionToken": "FQoDYXdzEE4aDHxO1jKhI0eNg9ZQTCK3A3EO38jNxvUNY1qznhPeDbf7eDW6xFEftTL6OoXygAbYx4jYFH0RTS7XT/JtKueFISrkafBJIFktoV+KK/EXClI9eCYGgl1c5NVaMV12XbzeDoPsZqa+V0M45hBAfBmWcGavrOib5DwKFhsyAEkLlh0DRoI1RYdUdJg7IAdS9E3HkARUQlrJ6Elh1X0nlyzhSXOW9BfXIZTmdlXbulRQe+0xbts8c5qrLLudPLj6FN7a4JQG0vGFjDWA2LwgydebogHQsvGefWQZGXW5zrirDdyaEzGQxfa9fDhDUuPTuz4GmgvSolWw46vXpX1fDFRlnVGhe3r/CxQFvRFQtlMiOCKAOhgwFRrlDRObwkO3fXe9WIab7n+t9EqERJrsvIQHcGUZHigsH5RNS8M50zUqaeP6RgCey1kkPpqXW+XZTabo2VxtEvwNHOa2zrscZCMzt0ETxuoOi08KuL5ZDy0xkl14bQRFYEwnpznZwcjsmnmOvLwspGgUzdytAmMB2TagpNPDmGSGUAN195fLzuCxVlztcoH91juVZVaAd3B9rlPXnWH791VQmh/IB3/G6TVVvGbuMUDRJJ4oh6vSxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "158618d-28bd-44ed-b06b-33c29e2e59cc", "record_id": "flaws_cloudtrail:0000324:158618d-28bd-44ed-b06b-33c29e2e59cc", "row_index": 324, "timestamp": "2017-02-27T21:10:42Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "162.255.129.1", "user_agent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 768, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "158618d-28bd-44ed-b06b-33c29e2e59cc", "eventTime": "2017-02-27T21:10:42Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "162.255.129.1", "userAgent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "69c832fb-0519-42a1-80ab-4d59c316d5ff", "record_id": "flaws_cloudtrail:0000325:69c832fb-0519-42a1-80ab-4d59c316d5ff", "row_index": 325, "timestamp": "2017-02-27T21:11:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "69c832fb-0519-42a1-80ab-4d59c316d5ff", "eventTime": "2017-02-27T21:11:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ce9e04c-c2c6-4d6d-92d4-f5027bce6f95", "record_id": "flaws_cloudtrail:0000326:7ce9e04c-c2c6-4d6d-92d4-f5027bce6f95", "row_index": 326, "timestamp": "2017-02-27T21:11:20Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "162.255.129.1", "user_agent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 769, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ce9e04c-c2c6-4d6d-92d4-f5027bce6f95", "eventTime": "2017-02-27T21:11:20Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "162.255.129.1", "userAgent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "responseElements": {"userId": "AIDADO2GQD0K8TEF7KW1V", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ec75d932-b06b-4f16-9411-5e0d1ee7c1fd", "record_id": "flaws_cloudtrail:0000327:ec75d932-b06b-4f16-9411-5e0d1ee7c1fd", "row_index": 327, "timestamp": "2017-02-27T21:11:32Z", "event_type": "GetAccountAuthorizationDetails", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "162.255.129.1", "user_agent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 681, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ec75d932-b06b-4f16-9411-5e0d1ee7c1fd", "eventTime": "2017-02-27T21:11:32Z", "eventName": "GetAccountAuthorizationDetails", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "162.255.129.1", "userAgent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1b510bd4-9140-495e-896c-95d68e5ccae0", "record_id": "flaws_cloudtrail:0000328:1b510bd4-9140-495e-896c-95d68e5ccae0", "row_index": 328, "timestamp": "2017-02-27T21:11:44Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.12.250.95", "user_agent": "[aws-cli/1.10.1 Python/3.5.2+ Linux/4.6.0-kali1-amd64 botocore/1.3.23]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 650, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1b510bd4-9140-495e-896c-95d68e5ccae0", "eventTime": "2017-02-27T21:11:44Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.12.250.95", "userAgent": "[aws-cli/1.10.1 Python/3.5.2+ Linux/4.6.0-kali1-amd64 botocore/1.3.23]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "081162c58-7923-46f9-9b4f-3bb37bbcdad0", "record_id": "flaws_cloudtrail:0000329:081162c58-7923-46f9-9b4f-3bb37bbcdad0", "row_index": 329, "timestamp": "2017-02-27T21:12:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 786, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "081162c58-7923-46f9-9b4f-3bb37bbcdad0", "eventTime": "2017-02-27T21:12:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7b9f8388-e53e-4c92-a8da-11cfe06ad621", "record_id": "flaws_cloudtrail:0000330:7b9f8388-e53e-4c92-a8da-11cfe06ad621", "row_index": 330, "timestamp": "2017-02-27T21:12:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 899, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7b9f8388-e53e-4c92-a8da-11cfe06ad621", "eventTime": "2017-02-27T21:12:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-west-2", "errorCode": "Client.InvalidSnapshot.NotFound", "errorMessage": "The snapshot 'snap-00d76804483fa3e93' does not exist.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"snapshotSet": {"items": [{"snapshotId": "snap-00d76804483fa3e93"}]}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "411215-e233-47f5-949e-a49fa9790e42", "record_id": "flaws_cloudtrail:0000331:411215-e233-47f5-949e-a49fa9790e42", "row_index": 331, "timestamp": "2017-02-27T21:12:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "411215-e233-47f5-949e-a49fa9790e42", "eventTime": "2017-02-27T21:12:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"snapshotSet": {"items": [{"snapshotId": "snap-4fd281251b99202a3"}]}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9320a4f5-ce76-41ba-a99e-938191d81a99", "record_id": "flaws_cloudtrail:0000332:9320a4f5-ce76-41ba-a99e-938191d81a99", "row_index": 332, "timestamp": "2017-02-27T21:14:50Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "162.255.129.1", "user_agent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 681, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9320a4f5-ce76-41ba-a99e-938191d81a99", "eventTime": "2017-02-27T21:14:50Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "162.255.129.1", "userAgent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "518db3ef-0ee9-45c8-9e01-4472a8df30b3", "record_id": "flaws_cloudtrail:0000333:518db3ef-0ee9-45c8-9e01-4472a8df30b3", "row_index": 333, "timestamp": "2017-02-27T21:14:51Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "162.255.129.1", "user_agent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 805, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "518db3ef-0ee9-45c8-9e01-4472a8df30b3", "eventTime": "2017-02-27T21:14:51Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "162.255.129.1", "userAgent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "AC+wGmRrh/A1EBZaaBqRTzmMpvfYJWYVVl6wyfPovDk1IWEbN5XfXQUtNWjM/DwiVVvOX1QyToQkx/UeZwS3jd0+YqAxw2rrRkRLAixj7nc1GQ==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2e3bdf63-3545-4fd4-b90f-9098632e4edf", "record_id": "flaws_cloudtrail:0000334:2e3bdf63-3545-4fd4-b90f-9098632e4edf", "row_index": 334, "timestamp": "2017-02-27T21:14:51Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "162.255.129.1", "user_agent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 805, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2e3bdf63-3545-4fd4-b90f-9098632e4edf", "eventTime": "2017-02-27T21:14:51Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "162.255.129.1", "userAgent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ACmM0zKIFtSk2i8tdt5R86XMadu+w9sfd4kpY3hhH3q9PdPbWSQH1SpDc3KRAGL+8iSTGMy9Wkw2oZ5AO1Grx0qtIh0CWzaspttkYsqbJ1M73Q==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "98d802bc-d00f-457e-adce-d9422be2756a", "record_id": "flaws_cloudtrail:0000335:98d802bc-d00f-457e-adce-d9422be2756a", "row_index": 335, "timestamp": "2017-02-27T21:14:59Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "11.253.189.153", "user_agent": "[aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 644, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "98d802bc-d00f-457e-adce-d9422be2756a", "eventTime": "2017-02-27T21:14:59Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "11.253.189.153", "userAgent": "[aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c20f1e5f-425b-4751-964d-36b2349efab5", "record_id": "flaws_cloudtrail:0000336:c20f1e5f-425b-4751-964d-36b2349efab5", "row_index": 336, "timestamp": "2017-02-27T21:15:47Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "162.255.129.1", "user_agent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 681, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c20f1e5f-425b-4751-964d-36b2349efab5", "eventTime": "2017-02-27T21:15:47Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "162.255.129.1", "userAgent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "608973-2281-4b6f-afe2-172a3bd5b261", "record_id": "flaws_cloudtrail:0000337:608973-2281-4b6f-afe2-172a3bd5b261", "row_index": 337, "timestamp": "2017-02-27T21:15:48Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "162.255.129.1", "user_agent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "608973-2281-4b6f-afe2-172a3bd5b261", "eventTime": "2017-02-27T21:15:48Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "162.255.129.1", "userAgent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ABVAFmzhWmbOZykDK6Fmy9HWKnqijwGkVWyXIxUepEXX+ri8W2Lx4n56fxX22Ay+GwlEEE9BXjxjfz3neI2Gw383YsannIImVU/h4m+fgDj7DQ==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be20e4b4-e49c-41fc-9e3d-5843f0a6f4d0", "record_id": "flaws_cloudtrail:0000338:be20e4b4-e49c-41fc-9e3d-5843f0a6f4d0", "row_index": 338, "timestamp": "2017-02-27T21:15:48Z", "event_type": "ListPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "162.255.129.1", "user_agent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 805, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be20e4b4-e49c-41fc-9e3d-5843f0a6f4d0", "eventTime": "2017-02-27T21:15:48Z", "eventName": "ListPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "162.255.129.1", "userAgent": "aws-cli/1.10.51 Python/2.7.13 Darwin/16.3.0 botocore/1.4.41", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"marker": "ABCGvber+g/Usb3LRODRY29L2ROVFOJR0YVxPxTCkxu/4Rnm4b+jI0Q0uEfKSgdEqU9zrNxwB6F4NXjQr0yrs8AV3dO+aE7Xs+0PSJQirrKDbQ==", "onlyAttached": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "515fe751-2be8-4920-b8c8-88823c943457e", "record_id": "flaws_cloudtrail:0000339:515fe751-2be8-4920-b8c8-88823c943457e", "row_index": 339, "timestamp": "2017-02-27T21:17:30Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "11.253.189.153", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 771, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "515fe751-2be8-4920-b8c8-88823c943457e", "eventTime": "2017-02-27T21:17:30Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "11.253.189.153", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0534af22-dfd5-447a-8c5f-26343de0add0", "record_id": "flaws_cloudtrail:0000340:0534af22-dfd5-447a-8c5f-26343de0add0", "row_index": 340, "timestamp": "2017-02-27T21:17:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "11.253.189.153", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 785, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0534af22-dfd5-447a-8c5f-26343de0add0", "eventTime": "2017-02-27T21:17:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "11.253.189.153", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "31a2720f-cdb9-43f3-bdd0-eb73969f6", "record_id": "flaws_cloudtrail:0000341:31a2720f-cdb9-43f3-bdd0-eb73969f6", "row_index": 341, "timestamp": "2017-02-27T21:21:17Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAN4AJ104O9WZVZBR9", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "153.56.248.251", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1028, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "31a2720f-cdb9-43f3-bdd0-eb73969f6", "eventTime": "2017-02-27T21:21:17Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "153.56.248.251", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAN4AJ104O9WZVZBR9", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-02-27T19:19:05Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logStreamName": "2017/02/27/[$LATEST]ee35f402e6bdf03fcf7b7f6b0ffa79a2", "logGroupName": "/aws/lambda/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ea2f8d3e-90b9-4cf2-af2d-3f4b78d42fec", "record_id": "flaws_cloudtrail:0000342:ea2f8d3e-90b9-4cf2-af2d-3f4b78d42fec", "row_index": 342, "timestamp": "2017-02-27T21:22:06Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 785, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ea2f8d3e-90b9-4cf2-af2d-3f4b78d42fec", "eventTime": "2017-02-27T21:22:06Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "97d3eca2-c161-4c7b-82f3-6f376e3b6543", "record_id": "flaws_cloudtrail:0000343:97d3eca2-c161-4c7b-82f3-6f376e3b6543", "row_index": 343, "timestamp": "2017-02-27T21:22:27Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 785, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "97d3eca2-c161-4c7b-82f3-6f376e3b6543", "eventTime": "2017-02-27T21:22:27Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0f269ad7-445a-4351-bafe-635f95cfde97", "record_id": "flaws_cloudtrail:0000344:0f269ad7-445a-4351-bafe-635f95cfde97", "row_index": 344, "timestamp": "2017-02-27T21:40:49Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "182.214.204.241", "user_agent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 762, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0f269ad7-445a-4351-bafe-635f95cfde97", "eventTime": "2017-02-27T21:40:49Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "182.214.204.241", "userAgent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "14129f49-91e8-4af4-b06a-af4234516180", "record_id": "flaws_cloudtrail:0000345:14129f49-91e8-4af4-b06a-af4234516180", "row_index": 345, "timestamp": "2017-02-27T21:40:51Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "182.214.204.241", "user_agent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "14129f49-91e8-4af4-b06a-af4234516180", "eventTime": "2017-02-27T21:40:51Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "182.214.204.241", "userAgent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJ0WjU0Y0EvakF2WUhUdDlldnZwUmNEbVpoZG9PQ2h5bXJicGs0YnVHQUlQclVkMUFRNFR5VVRuamw5d3BxMlUxd0c2S3l4ZU1IamE3eEo3Y3AySml5MHdhUElaSjlaUnhZN2QzUEx5RnIvNXc3bHhOc085NkU5RnhqTEVxS0ZKYUNnS3gvdm5Sa3ZVZ1JiN3NGTHVzSUE9PSIsImkiOiJXcVFhSlJiT3J4eGw1ckkzVWVxZFZBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "86c6261d-0b49-4abe-9efd-9c01c121c748", "record_id": "flaws_cloudtrail:0000346:86c6261d-0b49-4abe-9efd-9c01c121c748", "row_index": 346, "timestamp": "2017-02-27T21:40:53Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "182.214.204.241", "user_agent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1053, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "86c6261d-0b49-4abe-9efd-9c01c121c748", "eventTime": "2017-02-27T21:40:53Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "182.214.204.241", "userAgent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJpYk1wbmNHNmIwcjlWVjF4eFdVb0pvLzg0cURZTndpSDlvVlhRbzFpMGxCUDVnaXBOR1ZIU1RjeC9FNnJiQlB3dGhXamRqY2VjUnI2QXAvc2k3T1FFaC9PaHdDQ3lSTCtaeHNDVll0SzJSYWtSSmlkZmh0R0hIdG5kL1hFWE1QZVJSYnRpS0kzbTBjVHpDL3E1VFdacVE9PSIsImkiOiJGRVVRS1pNcnFiSk1uS1lybWJPWEtBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4713b008-c8b8-4766-baa0-cb5411c508ed", "record_id": "flaws_cloudtrail:0000347:4713b008-c8b8-4766-baa0-cb5411c508ed", "row_index": 347, "timestamp": "2017-02-27T21:40:55Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "182.214.204.241", "user_agent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1053, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4713b008-c8b8-4766-baa0-cb5411c508ed", "eventTime": "2017-02-27T21:40:55Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "182.214.204.241", "userAgent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJZZEJwWkduV1F1VUR2U0VJWFFtNEY3bDFHSHBvdlpyT0tmaTVlUUFTZUFwSFpQSzZWWFpCTlhtWnE2cERyakNwQ3dkUXUvRkdqaEZydFBuSUJNeWpCN0UvOVRyWUFIZnMyNjN4VnJpYVp4QzVxWkZsMGZ4VndOa25RelB2b3o1V2VnMXp5QVJnYTlQdlFnM0N1RTNDWnc9PSIsImkiOiJVZmhxVk5aS1ZKR3pwK29saFRhZVhnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ec236a72-7e8c-45bf-8fa6-2ee9a2eaeab3", "record_id": "flaws_cloudtrail:0000348:ec236a72-7e8c-45bf-8fa6-2ee9a2eaeab3", "row_index": 348, "timestamp": "2017-02-27T21:40:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "182.214.204.241", "user_agent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1051, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ec236a72-7e8c-45bf-8fa6-2ee9a2eaeab3", "eventTime": "2017-02-27T21:40:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "182.214.204.241", "userAgent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJyTHYySVY4WmlFWmxOVDZCOWF0NW9lMklpTWJ5MU1xU2JGVSsySktxMEJWS29Dc2lzQ201d2NSQXJoZCtHYUpoSkRVRWZ5VUdaYjJPc0kya1VLMTBiV0VXVjhmZitieGM5UG9LbzJ4cE9nVVBpd0hZR1E5Q1hsMG50T0dHNXNqNXBEVzhRaWJHQWVzUy9wYkhqMklacUE9PSIsImkiOiJYNDQvMUJiTVFlT2FvU0RpckNYTE53PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9d53add4-9199-4908-b143-20bfe718bcc0", "record_id": "flaws_cloudtrail:0000349:9d53add4-9199-4908-b143-20bfe718bcc0", "row_index": 349, "timestamp": "2017-02-27T21:40:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "182.214.204.241", "user_agent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1053, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9d53add4-9199-4908-b143-20bfe718bcc0", "eventTime": "2017-02-27T21:40:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "182.214.204.241", "userAgent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJQU1FsZG5KZ1BYZU9wdHkrczZpYkNRYnV6K3JDWVJ6cUF3c2lHaWY3Nm5ybGJkRmhSWEFxVG9ZdnZBR0NXc0s1K1NyenFOSXoxR040UlhMTm1xb2xLNElEZEVCQTVVQmFjR3J4ekJxWFBIWG5pTnlqL2NhU2lGTGlwYVhJT28raXliaGxWZUk2WTdNdGlUOXVYbUlUTUE9PSIsImkiOiJLMGFDZEI0bDFpZ0JzM25uYUVrRENnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "05c4b7db-62f9-4ae8-8157-37de390bd4b1", "record_id": "flaws_cloudtrail:0000350:05c4b7db-62f9-4ae8-8157-37de390bd4b1", "row_index": 350, "timestamp": "2017-02-27T21:41:00Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "182.214.204.241", "user_agent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1053, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "05c4b7db-62f9-4ae8-8157-37de390bd4b1", "eventTime": "2017-02-27T21:41:00Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "182.214.204.241", "userAgent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJhOTY0SHl1Tmc2YXFCNTVOMnpWUHA3bkZrZmtxRW9FNFJQRkQ3VVZlTnBnazhmT3JscmE1S2VEdHZ6YkkxQzJJRzhvcGNVM1E3WE5ScFQwbHRPaUEzRk9zK2YxMEw2VjQxc1RWczJMcGIzNlpERHdnV3ZHOVpjNHhrTzdId3FDbVpYdDFRR2wvV3orcloxcTRXcVhSQVE9PSIsImkiOiJMQjJFVjBzaGJrd0JnR21md2RtSjZnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a76187e-a462-429d-8410-beb7f9ca10af", "record_id": "flaws_cloudtrail:0000351:a76187e-a462-429d-8410-beb7f9ca10af", "row_index": 351, "timestamp": "2017-02-27T21:41:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "182.214.204.241", "user_agent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a76187e-a462-429d-8410-beb7f9ca10af", "eventTime": "2017-02-27T21:41:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "182.214.204.241", "userAgent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJiVWdzYjQ2U0Z4TGxYNlRiaUVRRmRxaUlsMlVKVkp4THN4Q00vSTlCTnpZbEE4cCtSTFU0cjZlVUNUclowUXZaOC9NSzVPT2VTZEM2bEVkVUlEY3dVbWZqaXdPV3RKbENxa2dXenNKcTlNdGUwQ0FHNDJ1bkJ0K1JLZTR0bG1JMVMzZjBvc3FMS0dQY0d5WXJzZ2FLSnc9PSIsImkiOiJtSWlpc0N4eGpYVlBJQW1SK1Rvc0JBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a3092b5f-9718-4121-b8aa-48f5cf60eaab", "record_id": "flaws_cloudtrail:0000352:a3092b5f-9718-4121-b8aa-48f5cf60eaab", "row_index": 352, "timestamp": "2017-02-27T21:42:00Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "182.214.204.241", "user_agent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 762, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a3092b5f-9718-4121-b8aa-48f5cf60eaab", "eventTime": "2017-02-27T21:42:00Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "182.214.204.241", "userAgent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "064446d2-87d4-4006-90ed-cc924ab0c15a", "record_id": "flaws_cloudtrail:0000353:064446d2-87d4-4006-90ed-cc924ab0c15a", "row_index": 353, "timestamp": "2017-02-27T21:42:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "182.214.204.241", "user_agent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1053, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "064446d2-87d4-4006-90ed-cc924ab0c15a", "eventTime": "2017-02-27T21:42:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "182.214.204.241", "userAgent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJlbHkra3I0aVk2QVZBZ0txdm9rRGJtWkRWUWJ2WGVZbFNKbWFPTS96UTRqbnRpYmRENzA1Slk0TXhsVngzL25Za25qaXcwQWNrY0QyTUlrbWlKWktib1lRNGFUL1ROMmxDSkw4Y0pkVGtvSmpUSUs2WTBTdDQxQ1dnb3BnSnE1MkJvbVp4LzB6YWVoKzB6anUwY0dESUE9PSIsImkiOiJlZUxJeEdPWHpCbGRkZlpLTUFaWC93PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d32bf496-7272-481c-9b4d-ac2eb889a66b", "record_id": "flaws_cloudtrail:0000354:d32bf496-7272-481c-9b4d-ac2eb889a66b", "row_index": 354, "timestamp": "2017-02-27T21:42:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "182.214.204.241", "user_agent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d32bf496-7272-481c-9b4d-ac2eb889a66b", "eventTime": "2017-02-27T21:42:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "182.214.204.241", "userAgent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiIyYzUwQXBjczBRV0hpNjAxMUlKbUtkdVVlZWJ5NTdoN0VYNy9WNTIwTE4rVmVUckV0S2c0V3ByUkkrekxhMG55ZHFnb0g2NFRxRG82L1B4aGNDbkJVU1dLSnhxOTl5WGhZYUZzS2p5R3RXRGtMajdZWGVYYnJ6NU55WDlYY1JkbUQyZ0JhbFBLVGFPTHNxS3Vud2YwNEE9PSIsImkiOiJJNmxzenAxSW5HOFE0RHNCSWZIRE53PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a6571dda-335c-45e9-98f6-0a52ea98e8e9", "record_id": "flaws_cloudtrail:0000355:a6571dda-335c-45e9-98f6-0a52ea98e8e9", "row_index": 355, "timestamp": "2017-02-27T21:42:02Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "182.214.204.241", "user_agent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1053, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a6571dda-335c-45e9-98f6-0a52ea98e8e9", "eventTime": "2017-02-27T21:42:02Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "182.214.204.241", "userAgent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJPZmdhZTN6UlFsSDRubjBoSld6MXdQOHRkYUNUVlNOM3NmQ1RkTVhLODJ0c1ZTODBKV2UvcUlmMDFVd3NMVkVPbEhxVFdVZVRvcnlVKzZNWkU3RFlVVHRuNG5tWHhYSGNJSGRYM2RHQXYxT2krRjI5ZU5RQ3FLek5BVUtSMVBEalE2dmROcEZ0clp0bUdNU0gvd3NWL0E9PSIsImkiOiI5dFRFZUdkY3NuTkRBa1hNUmlQVVp3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ca9427a2-3f76-4185-835e-c6a9a533e79e", "record_id": "flaws_cloudtrail:0000356:ca9427a2-3f76-4185-835e-c6a9a533e79e", "row_index": 356, "timestamp": "2017-02-27T21:42:02Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "182.214.204.241", "user_agent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1053, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ca9427a2-3f76-4185-835e-c6a9a533e79e", "eventTime": "2017-02-27T21:42:02Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "182.214.204.241", "userAgent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJpMmJoYSs4K2c4eGRuU1pQNWpaNkRMRlhqMVZWSjRnWXNiRFE3YitXdXBxZUhqWWM2L29Xc05iaVQrb3luNy9TZGQ3ZFBENCtrUThTSUpwV3MvL1lmbU50VjRFMDk1RW1wZnJHOUlsMnRCeHljWHdnOVFUS25DaW1zTzUwYWdmQ1Q0dUFwRi9FMzFyS05uK2NUcHRsMnc9PSIsImkiOiJESVVyNGlaWkxnOVVTa0tpWDBTaXp3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fee8d8c0-1103-4879-a417-9a0ddae04d45", "record_id": "flaws_cloudtrail:0000357:fee8d8c0-1103-4879-a417-9a0ddae04d45", "row_index": 357, "timestamp": "2017-02-27T21:42:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "182.214.204.241", "user_agent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1053, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fee8d8c0-1103-4879-a417-9a0ddae04d45", "eventTime": "2017-02-27T21:42:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "182.214.204.241", "userAgent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJXRjQ5RVBUaXQxMU5LVWJWY0FVNzVCK2cxZC94N1R1cUtUajFHekY2LzVvZml1dFFPRWF4bGEwMEpNWG1Pck5hM251YW5aQ1JoTDdHN0VPRk9kaWgvcW0zNEFNNWJDUlN5VENNbDdhejhVYngvMjdYUWpOb2t2U1VBRTBtWW16blJYTU4yYWtsQnFaS1hyTFZIdTVUT2c9PSIsImkiOiJMa2gwOGoxdDFiYUhnUTlSR0N3VTNBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f388c216-9604-4545-99fd-9ff64c046566", "record_id": "flaws_cloudtrail:0000358:f388c216-9604-4545-99fd-9ff64c046566", "row_index": 358, "timestamp": "2017-02-27T21:42:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "182.214.204.241", "user_agent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f388c216-9604-4545-99fd-9ff64c046566", "eventTime": "2017-02-27T21:42:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "182.214.204.241", "userAgent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJCVDZLRFJXSXdCQWlhZVhadGRKWTFpR2dpckdNZmVyNmJKRUExOExiUTJTS2syNDdldXhNUU0xQ1BzRXl2RGVaVzQwMFRMZ0Q5SGI5YmxHT3FsZW9NWVM5ZDFjaU43VjNiclIxRXFmbWE2NnNiejVsUm5qSHRCYUgveURQWHNVSExOMWNhOWVUTERJZEtpMTRGakUrbFE9PSIsImkiOiJ2S3pLWUNHdU5Kb2txbG9FektNcU9nPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8f9710d5-5260-4939-b51b-3d452dc73b83", "record_id": "flaws_cloudtrail:0000359:8f9710d5-5260-4939-b51b-3d452dc73b83", "row_index": 359, "timestamp": "2017-02-27T21:42:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "182.214.204.241", "user_agent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8f9710d5-5260-4939-b51b-3d452dc73b83", "eventTime": "2017-02-27T21:42:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "182.214.204.241", "userAgent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiI1eVVFUlJzZE4vakwxaTFZV3I4cmlhQS9OT285YVo4cmxGSk5leGMzSnh1WExpQzMzbzRSR01rcGVySlVveWFkRFdQeXdxRW52cXRMNjNYL0xmbm9jSFBFWk9sY0dON0FLbGZkRjhCZFdaRTE4YW9NZXlqQU1ITVdDajlUa3V1WHh6dFMwR2o0T280YnpGWkFBRTBEQXc9PSIsImkiOiJBdUJpRXllTUkrVER2VFI3TUhCYnhnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "10e3f389-20c8-4ba9-be26-fce6212cc45e", "record_id": "flaws_cloudtrail:0000360:10e3f389-20c8-4ba9-be26-fce6212cc45e", "row_index": 360, "timestamp": "2017-02-27T21:43:56Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "182.214.204.241", "user_agent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 781, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "10e3f389-20c8-4ba9-be26-fce6212cc45e", "eventTime": "2017-02-27T21:43:56Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "182.214.204.241", "userAgent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d47d1368-093e-415e-b52b-73dc00af5268", "record_id": "flaws_cloudtrail:0000361:d47d1368-093e-415e-b52b-73dc00af5268", "row_index": 361, "timestamp": "2017-02-27T21:44:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "182.214.204.241", "user_agent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 796, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d47d1368-093e-415e-b52b-73dc00af5268", "eventTime": "2017-02-27T21:44:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "182.214.204.241", "userAgent": "aws-cli/1.11.55 Python/2.7.12+ Linux/4.8.0-39-generic botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d518f5c9-bc55-49aa-93da-93acc0b077c9", "record_id": "flaws_cloudtrail:0000362:d518f5c9-bc55-49aa-93da-93acc0b077c9", "row_index": 362, "timestamp": "2017-02-27T21:47:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 784, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d518f5c9-bc55-49aa-93da-93acc0b077c9", "eventTime": "2017-02-27T21:47:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e4518baa-348c-4c17-9069-2cb24ba94d68", "record_id": "flaws_cloudtrail:0000363:e4518baa-348c-4c17-9069-2cb24ba94d68", "row_index": 363, "timestamp": "2017-02-27T21:55:20Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "[aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 645, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e4518baa-348c-4c17-9069-2cb24ba94d68", "eventTime": "2017-02-27T21:55:20Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "[aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be08a00e-bac2-4429-9da7-b1968e47a36b", "record_id": "flaws_cloudtrail:0000364:be08a00e-bac2-4429-9da7-b1968e47a36b", "row_index": 364, "timestamp": "2017-02-27T22:06:28Z", "event_type": "DescribeHosts", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "136.195.245.225", "user_agent": "aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 700, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be08a00e-bac2-4429-9da7-b1968e47a36b", "eventTime": "2017-02-27T22:06:28Z", "eventName": "DescribeHosts", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "136.195.245.225", "userAgent": "aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"DescribeHostsRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8e9f6b4b-885b-4f74-8175-d788a4fa13b3", "record_id": "flaws_cloudtrail:0000365:8e9f6b4b-885b-4f74-8175-d788a4fa13b3", "row_index": 365, "timestamp": "2017-02-27T22:06:43Z", "event_type": "DescribeHosts", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "136.195.245.225", "user_agent": "aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8e9f6b4b-885b-4f74-8175-d788a4fa13b3", "eventTime": "2017-02-27T22:06:43Z", "eventName": "DescribeHosts", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "136.195.245.225", "userAgent": "aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"DescribeHostsRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "49d14b43-995f-45dd-a1d9-45c5779d92be", "record_id": "flaws_cloudtrail:0000366:49d14b43-995f-45dd-a1d9-45c5779d92be", "row_index": 366, "timestamp": "2017-02-27T22:06:59Z", "event_type": "DescribeHosts", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "136.195.245.225", "user_agent": "aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "49d14b43-995f-45dd-a1d9-45c5779d92be", "eventTime": "2017-02-27T22:06:59Z", "eventName": "DescribeHosts", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "136.195.245.225", "userAgent": "aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"DescribeHostsRequest": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "26be6804-6062-4491-8784-8d5a477801", "record_id": "flaws_cloudtrail:0000367:26be6804-6062-4491-8784-8d5a477801", "row_index": 367, "timestamp": "2017-02-27T22:07:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "136.195.245.225", "user_agent": "aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 762, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "26be6804-6062-4491-8784-8d5a477801", "eventTime": "2017-02-27T22:07:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "136.195.245.225", "userAgent": "aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "66ce7ef5-1d06-450e-974b-a2480f64bbc6", "record_id": "flaws_cloudtrail:0000368:66ce7ef5-1d06-450e-974b-a2480f64bbc6", "row_index": 368, "timestamp": "2017-02-27T22:10:43Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1477, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "66ce7ef5-1d06-450e-974b-a2480f64bbc6", "eventTime": "2017-02-27T22:10:43Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIADAEE8V2V0R2DIPBX", "expiration": "Feb 28, 2017 4:26:17 AM", "sessionToken": "FQoDYXdzEE8aDLqebV2LMLeJVprz6SK3A5G3j6LjrtjEtgWeD5iG6/unoeYHqg6dLIEJvEA74fImiSxJLX5GXUG9qlC+Twpb+ZFbd/BfftRAKG4TR0sEXS12oUuZkUDKiOFbiktb7l3T+HLr2OmtAB2AvyhwuKJeI0xt2t4x5z3/BKJaT/He47Wgn9j/PPL3ptJ2W9n3BaYvGNNrY6YcfJWHzstbyVPX8A/6aVTTlmdJ1HLm/2SM2CtR/mFT4i662pxVYKWUBgp03su1MJFog7xvXMCgLWi8T5+T6vRE7hkYwOQAgbuUlP2h/qVI8CWg3vIROXlX53iKk/pFeaWuVcEf6C1f7ndGGkBAd/N5V5py5/ZCAd2LRor0FhgHHY3NTDp91zKkHNbywiBrl5DUObJK+ybC9N0kANumuof3KF7dmuBP8/2DGTBwU0Hl3ipRCDhF/xRtac91hdmvHyUsohIYG1h1oZdcHNwFUHXF+vIMEKZbXOeIQhxoZii3k8rnfSG+FjRGXjVh3SizU3OkC2uBaMIh8mvQgxyeyhgvQteA1OiX2/vbzB21ShsrxIJSdgz9EAYLUu8VFjVZ6tGBNGgiqwZAm0lijE4qZO0XqgUo48fSxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4a119a3c-c90e-4e7a-98b3-99338f19fd4f", "record_id": "flaws_cloudtrail:0000369:4a119a3c-c90e-4e7a-98b3-99338f19fd4f", "row_index": 369, "timestamp": "2017-02-27T22:12:10Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.6.135.215", "user_agent": "[aws-cli/1.11.3 Python/2.7.10 Darwin/16.4.0 botocore/1.4.61]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 642, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4a119a3c-c90e-4e7a-98b3-99338f19fd4f", "eventTime": "2017-02-27T22:12:10Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.6.135.215", "userAgent": "[aws-cli/1.11.3 Python/2.7.10 Darwin/16.4.0 botocore/1.4.61]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8e255a71-d9d6-40ee-a653-e175291b74c0b", "record_id": "flaws_cloudtrail:0000370:8e255a71-d9d6-40ee-a653-e175291b74c0b", "row_index": 370, "timestamp": "2017-02-27T22:14:19Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.6.135.215", "user_agent": "[aws-cli/1.11.3 Python/2.7.10 Darwin/16.4.0 botocore/1.4.61]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 643, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8e255a71-d9d6-40ee-a653-e175291b74c0b", "eventTime": "2017-02-27T22:14:19Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.6.135.215", "userAgent": "[aws-cli/1.11.3 Python/2.7.10 Darwin/16.4.0 botocore/1.4.61]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "72b3c5c7-cf6d-4e96-9558-8d79282e36ed", "record_id": "flaws_cloudtrail:0000371:72b3c5c7-cf6d-4e96-9558-8d79282e36ed", "row_index": 371, "timestamp": "2017-02-27T22:14:55Z", "event_type": "ListAccountAliases", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "136.195.245.225", "user_agent": "aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 824, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "72b3c5c7-cf6d-4e96-9558-8d79282e36ed", "eventTime": "2017-02-27T22:14:55Z", "eventName": "ListAccountAliases", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "136.195.245.225", "userAgent": "aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListAccountAliases", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "392a6d2f-c72b-4500-807d-d7e84710ead9", "record_id": "flaws_cloudtrail:0000372:392a6d2f-c72b-4500-807d-d7e84710ead9", "row_index": 372, "timestamp": "2017-02-27T22:16:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "136.195.245.225", "user_agent": "aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 795, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "392a6d2f-c72b-4500-807d-d7e84710ead9", "eventTime": "2017-02-27T22:16:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "136.195.245.225", "userAgent": "aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7f7e2780-95e1-4c14-ae58-300cbb1d1a1f", "record_id": "flaws_cloudtrail:0000373:7f7e2780-95e1-4c14-ae58-300cbb1d1a1f", "row_index": 373, "timestamp": "2017-02-27T22:16:17Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "136.195.245.225", "user_agent": "aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 798, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7f7e2780-95e1-4c14-ae58-300cbb1d1a1f", "eventTime": "2017-02-27T22:16:17Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "136.195.245.225", "userAgent": "aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e240d789-1210-48b9-8694-de2c6d64ae5b", "record_id": "flaws_cloudtrail:0000374:e240d789-1210-48b9-8694-de2c6d64ae5b", "row_index": 374, "timestamp": "2017-02-27T22:22:13Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.6.135.215", "user_agent": "[aws-cli/1.11.3 Python/2.7.10 Darwin/16.4.0 botocore/1.4.61]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 642, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e240d789-1210-48b9-8694-de2c6d64ae5b", "eventTime": "2017-02-27T22:22:13Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.6.135.215", "userAgent": "[aws-cli/1.11.3 Python/2.7.10 Darwin/16.4.0 botocore/1.4.61]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7e2b48ff-5357-4f3a-9b71-e03f251783f25", "record_id": "flaws_cloudtrail:0000375:7e2b48ff-5357-4f3a-9b71-e03f251783f25", "row_index": 375, "timestamp": "2017-02-27T22:25:44Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "136.195.245.225", "user_agent": "aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 799, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7e2b48ff-5357-4f3a-9b71-e03f251783f25", "eventTime": "2017-02-27T22:25:44Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "136.195.245.225", "userAgent": "aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "589946bf-4b97-46b5-a2d3-d6c136127fb73", "record_id": "flaws_cloudtrail:0000376:589946bf-4b97-46b5-a2d3-d6c136127fb73", "row_index": 376, "timestamp": "2017-02-27T22:26:57Z", "event_type": "DescribeAccountAttributes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "136.195.245.225", "user_agent": "aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 732, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "589946bf-4b97-46b5-a2d3-d6c136127fb73", "eventTime": "2017-02-27T22:26:57Z", "eventName": "DescribeAccountAttributes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "136.195.245.225", "userAgent": "aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"accountAttributeNameSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6f9aa2e3-9e08-43c3-9935-78448e", "record_id": "flaws_cloudtrail:0000377:6f9aa2e3-9e08-43c3-9935-78448e", "row_index": 377, "timestamp": "2017-02-27T22:27:49Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "136.195.245.225", "user_agent": "aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 728, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6f9aa2e3-9e08-43c3-9935-78448e", "eventTime": "2017-02-27T22:27:49Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "136.195.245.225", "userAgent": "aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dda726090-9add-4282-ad5d-f4069d18350f", "record_id": "flaws_cloudtrail:0000378:dda726090-9add-4282-ad5d-f4069d18350f", "row_index": 378, "timestamp": "2017-02-27T22:29:08Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "136.195.245.225", "user_agent": "aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 735, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dda726090-9add-4282-ad5d-f4069d18350f", "eventTime": "2017-02-27T22:29:08Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "136.195.245.225", "userAgent": "aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "02ba9800-2ab5-4bb5-8e94-8e0d24210", "record_id": "flaws_cloudtrail:0000379:02ba9800-2ab5-4bb5-8e94-8e0d24210", "row_index": 379, "timestamp": "2017-02-27T22:29:44Z", "event_type": "DescribeFlowLogs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAAOLKBZ4KJAKZQA5S", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "02ba9800-2ab5-4bb5-8e94-8e0d24210", "eventTime": "2017-02-27T22:29:44Z", "eventName": "DescribeFlowLogs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAAOLKBZ4KJAKZQA5S", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-02-27T22:29:43Z"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "responseElements": {"flowLogSet": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7d67060-d4c5-499c-8f89-75eaf41607b4", "record_id": "flaws_cloudtrail:0000380:7d67060-d4c5-499c-8f89-75eaf41607b4", "row_index": 380, "timestamp": "2017-02-27T22:34:30Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "1.238.206.62", "user_agent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 766, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7d67060-d4c5-499c-8f89-75eaf41607b4", "eventTime": "2017-02-27T22:34:30Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "1.238.206.62", "userAgent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b4a3884d-02b6-49ed-9e38-cbde8d5d87d5", "record_id": "flaws_cloudtrail:0000381:b4a3884d-02b6-49ed-9e38-cbde8d5d87d5", "row_index": 381, "timestamp": "2017-02-27T22:35:15Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "1.238.206.62", "user_agent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b4a3884d-02b6-49ed-9e38-cbde8d5d87d5", "eventTime": "2017-02-27T22:35:15Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "1.238.206.62", "userAgent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3688e09c-6038-4a6d-ae86-b8fc087859c40", "record_id": "flaws_cloudtrail:0000382:3688e09c-6038-4a6d-ae86-b8fc087859c40", "row_index": 382, "timestamp": "2017-02-27T22:35:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "1.238.206.62", "user_agent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1040, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3688e09c-6038-4a6d-ae86-b8fc087859c40", "eventTime": "2017-02-27T22:35:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "1.238.206.62", "userAgent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJBK3AvUUFqRTlER0xyV2ZSTjd5Smd1ME5yUExWOVViVkNmRDhIblNJeWU1U204TDVSMlJIcXBuYlErYTNTTjZZYU5CVmw1b1lvSXpRL1ozcmpwWU1XOWdyY0w3UEhycE5GSFZwcUdRQVVUZjVDcHc4QWsxMG42OUhFSnJrMFZQMXUvT1FaSy85YnkxZ3ZBZkhVektNMFE9PSIsImkiOiJtMmpDV09LNXBkVm5SNFUyWlBPTUl3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "533a78fe-e426-46b3-b62f-7d60a25dbe36", "record_id": "flaws_cloudtrail:0000383:533a78fe-e426-46b3-b62f-7d60a25dbe36", "row_index": 383, "timestamp": "2017-02-27T22:35:28Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "1.238.206.62", "user_agent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1039, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "533a78fe-e426-46b3-b62f-7d60a25dbe36", "eventTime": "2017-02-27T22:35:28Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "1.238.206.62", "userAgent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJ2UlJXVUNSbm9LK2JzSElWKzVybHR3QkEwdTlXNXlDVTdSSlFOcmdwZE9tSDBEYTVnUzlJbk1YY212MndNc0hIZ3ZRZTRhTFdDa0J3UGlERzNYZUNwaTA4WjVYaUZ4cXZBbjdySFhHZGhZbk9lRmJQSWw1ZVAwa3NzeE41Y3UyLzBKL3VCeEpaMy9qQytSSTdjUzRyalE9PSIsImkiOiJsVE5qWnFYenY2UHJDK2c3UUNKNytBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c8f8792d-9691-418d-b536-af43bbd4c599", "record_id": "flaws_cloudtrail:0000384:c8f8792d-9691-418d-b536-af43bbd4c599", "row_index": 384, "timestamp": "2017-02-27T22:35:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "1.238.206.62", "user_agent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1039, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c8f8792d-9691-418d-b536-af43bbd4c599", "eventTime": "2017-02-27T22:35:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "1.238.206.62", "userAgent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJkTHo5NFlPSHRVaUd3U0NBa21GVWo5Y21sLzRpWTdBYUpyang1NVN4ZXpzN0xaaEdNS0F6dHl2YlR4SXdwMkVxaVN0RGk1SnVrSGRIYmR2SkVrcVJLK0l6ZUNKaGk5S1JvNFVDejRSTXJNbkNkVlVtSHNjOWlrcTZndTRZQmpGV0JxZTB0cS9LNVo5Rjl5c3ExYWZxOWc9PSIsImkiOiJabGRPNWNJREF1c0Iwam1OeWZwY2R3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "68dbad6d-0988-4538-8870-8cd84f190309", "record_id": "flaws_cloudtrail:0000385:68dbad6d-0988-4538-8870-8cd84f190309", "row_index": 385, "timestamp": "2017-02-27T22:35:41Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "1.238.206.62", "user_agent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1038, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "68dbad6d-0988-4538-8870-8cd84f190309", "eventTime": "2017-02-27T22:35:41Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "1.238.206.62", "userAgent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJySWhmV3pSbHRPd0FBc3hDaGdINVBwR016NG1HWFV5T2o3VVlyTldLUTNKSmRjMU1GUVlydWJaR0xhL3RuMWpQMStpRmx4VkZiTld0OUNYcCtpVFVMSnBkdGNua3Ayc2VFTGMySXNMRUdMenJOYUxjUEQ0RU5ZMjVhNGlSQ1NKWE1hd1FOUitBeHFJZEZncjJzc1JzMGc9PSIsImkiOiI4b2YrRmxnMjNta0N4bGpLcElJV293PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "929d3a24-0c12-4ae5-b820-a69b1c9be9f7", "record_id": "flaws_cloudtrail:0000386:929d3a24-0c12-4ae5-b820-a69b1c9be9f7", "row_index": 386, "timestamp": "2017-02-27T22:35:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "1.238.206.62", "user_agent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1039, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "929d3a24-0c12-4ae5-b820-a69b1c9be9f7", "eventTime": "2017-02-27T22:35:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "1.238.206.62", "userAgent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJZZWFWU213OUFHNlNreFkzczZ2dy84ODBvYXM5UFFPRnJldytYd2lQb01ac3FrN1RVQTRVOTBpOWV5djN2UitGOVliNWc4NUR0ZGlhZFFRbWtMN2ZhR0g5dkdoR2pmcmJ4cFJpZ0tVSVRaVXVjeU5vSk41VC9HMUhEb2dVRHczNjNDSnk3eldnMnpnK21MSm0wWUZPQ1E9PSIsImkiOiJ4bk5RbGFYR3hDRUl3ZHcwdS8xa2xRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "27e233a1-6928-45e2-ac19-f1f5567a1a53", "record_id": "flaws_cloudtrail:0000387:27e233a1-6928-45e2-ac19-f1f5567a1a53", "row_index": 387, "timestamp": "2017-02-27T22:35:52Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "1.238.206.62", "user_agent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1039, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "27e233a1-6928-45e2-ac19-f1f5567a1a53", "eventTime": "2017-02-27T22:35:52Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "1.238.206.62", "userAgent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiI0TDdPV2REQUNqcEgwYkxuZVZqb1Z1VVhjNUkzajlpWmZQVlJ1K3lROUxTandSRVNpTVA5ZlN5R2VVZlNHenBwMW5RaC92WEZma3BGTzN4RVlwVnpxTFZSNGhBc0IwZ1h0UUpoZHFkd3lSL0taUlFtU3VuOTNpWFJLN0hzcitNNWNteFlvd0cvU3Y3OTNuMnRWbVFkc2c9PSIsImkiOiJQdnJZYytRY1d0ZUM5TTNnalo4RHF3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4405c0f7-d3d3-4f79-b0fb-22d86cf00372", "record_id": "flaws_cloudtrail:0000388:4405c0f7-d3d3-4f79-b0fb-22d86cf00372", "row_index": 388, "timestamp": "2017-02-27T22:35:59Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "1.238.206.62", "user_agent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1039, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4405c0f7-d3d3-4f79-b0fb-22d86cf00372", "eventTime": "2017-02-27T22:35:59Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "1.238.206.62", "userAgent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJoY1ZoakZjRStPNGFoRXdEbmt1L0dYYUgyQ1pBWUdNWTVKcUFjKzVFb0FORFBGWGxXODIwamVyS0xNWmhlTEl6TVlSTCtBdEh2UU9wQXJtckRRajd3WFR4WHE1THJLY3JOQUpzamNIWXBBZVhYekQ0S2duKzY2VHBmOWl4WjJSZ1B3T0pRcnp2YmNVS3YvYzNIbFFpZFE9PSIsImkiOiJCcnVMaGtUamFoUE1jZXVickRpVUFBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "13fdb948-f2d4-4cf4-bf5b-68d6ac01f431", "record_id": "flaws_cloudtrail:0000389:13fdb948-f2d4-4cf4-bf5b-68d6ac01f431", "row_index": 389, "timestamp": "2017-02-27T22:36:52Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "1.238.206.62", "user_agent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "13fdb948-f2d4-4cf4-bf5b-68d6ac01f431", "eventTime": "2017-02-27T22:36:52Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "1.238.206.62", "userAgent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e603d5b6-5189-4754-abfb-486704b94984", "record_id": "flaws_cloudtrail:0000390:e603d5b6-5189-4754-abfb-486704b94984", "row_index": 390, "timestamp": "2017-02-27T22:38:10Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.255.28.91", "user_agent": "[aws-cli/1.11.50 Python/2.7.13 Linux/4.4.51-1-lts botocore/1.5.13]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 644, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e603d5b6-5189-4754-abfb-486704b94984", "eventTime": "2017-02-27T22:38:10Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.255.28.91", "userAgent": "[aws-cli/1.11.50 Python/2.7.13 Linux/4.4.51-1-lts botocore/1.5.13]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f74da7d9-9357-4876-9389-f779d835e468", "record_id": "flaws_cloudtrail:0000391:f74da7d9-9357-4876-9389-f779d835e468", "row_index": 391, "timestamp": "2017-02-27T22:38:40Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.255.28.91", "user_agent": "[aws-cli/1.11.50 Python/2.7.13 Linux/4.4.51-1-lts botocore/1.5.13]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 645, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f74da7d9-9357-4876-9389-f779d835e468", "eventTime": "2017-02-27T22:38:40Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.255.28.91", "userAgent": "[aws-cli/1.11.50 Python/2.7.13 Linux/4.4.51-1-lts botocore/1.5.13]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "26ae59d6-8d68-4363-aa8e-e0cb1324b97b", "record_id": "flaws_cloudtrail:0000392:26ae59d6-8d68-4363-aa8e-e0cb1324b97b", "row_index": 392, "timestamp": "2017-02-27T22:42:44Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.255.28.91", "user_agent": "[aws-cli/1.11.50 Python/2.7.13 Linux/4.4.51-1-lts botocore/1.5.13]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 645, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "26ae59d6-8d68-4363-aa8e-e0cb1324b97b", "eventTime": "2017-02-27T22:42:44Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.255.28.91", "userAgent": "[aws-cli/1.11.50 Python/2.7.13 Linux/4.4.51-1-lts botocore/1.5.13]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0aab9d97-7df0-46ac-b502-37a7a851b3f3", "record_id": "flaws_cloudtrail:0000393:0aab9d97-7df0-46ac-b502-37a7a851b3f3", "row_index": 393, "timestamp": "2017-02-27T22:44:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "1.238.206.62", "user_agent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0aab9d97-7df0-46ac-b502-37a7a851b3f3", "eventTime": "2017-02-27T22:44:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "1.238.206.62", "userAgent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2d31604a-1967-4ee2-84af-39c1a2377be0", "record_id": "flaws_cloudtrail:0000394:2d31604a-1967-4ee2-84af-39c1a2377be0", "row_index": 394, "timestamp": "2017-02-27T22:45:33Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.255.28.91", "user_agent": "aws-cli/1.11.50 Python/2.7.13 Linux/4.4.51-1-lts botocore/1.5.13", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 772, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2d31604a-1967-4ee2-84af-39c1a2377be0", "eventTime": "2017-02-27T22:45:33Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.255.28.91", "userAgent": "aws-cli/1.11.50 Python/2.7.13 Linux/4.4.51-1-lts botocore/1.5.13", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d4b1436b-4bf3-45d6-b07a-31881793cf92", "record_id": "flaws_cloudtrail:0000395:d4b1436b-4bf3-45d6-b07a-31881793cf92", "row_index": 395, "timestamp": "2017-02-27T22:45:59Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.255.28.91", "user_agent": "aws-cli/1.11.50 Python/2.7.13 Linux/4.4.51-1-lts botocore/1.5.13", "aws_region": "eu-west-2"}, "resource_arns": [], "raw_record_size_bytes": 784, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d4b1436b-4bf3-45d6-b07a-31881793cf92", "eventTime": "2017-02-27T22:45:59Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.255.28.91", "userAgent": "aws-cli/1.11.50 Python/2.7.13 Linux/4.4.51-1-lts botocore/1.5.13", "awsRegion": "eu-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a4654de5-bf9e-4ef7-9aa5-9c2d9bb34da8", "record_id": "flaws_cloudtrail:0000396:a4654de5-bf9e-4ef7-9aa5-9c2d9bb34da8", "row_index": 396, "timestamp": "2017-02-27T22:46:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.255.28.91", "user_agent": "aws-cli/1.11.50 Python/2.7.13 Linux/4.4.51-1-lts botocore/1.5.13", "aws_region": "eu-west-1"}, "resource_arns": [], "raw_record_size_bytes": 787, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a4654de5-bf9e-4ef7-9aa5-9c2d9bb34da8", "eventTime": "2017-02-27T22:46:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.255.28.91", "userAgent": "aws-cli/1.11.50 Python/2.7.13 Linux/4.4.51-1-lts botocore/1.5.13", "awsRegion": "eu-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b6c5a072-99a5-45b3-b658-a125994f", "record_id": "flaws_cloudtrail:0000397:b6c5a072-99a5-45b3-b658-a125994f", "row_index": 397, "timestamp": "2017-02-27T22:46:06Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.255.28.91", "user_agent": "aws-cli/1.11.50 Python/2.7.13 Linux/4.4.51-1-lts botocore/1.5.13", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b6c5a072-99a5-45b3-b658-a125994f", "eventTime": "2017-02-27T22:46:06Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.255.28.91", "userAgent": "aws-cli/1.11.50 Python/2.7.13 Linux/4.4.51-1-lts botocore/1.5.13", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fc73fd55-452b-47e3-b69f-75a43b3cf4bf", "record_id": "flaws_cloudtrail:0000398:fc73fd55-452b-47e3-b69f-75a43b3cf4bf", "row_index": 398, "timestamp": "2017-02-27T22:46:09Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.255.28.91", "user_agent": "aws-cli/1.11.50 Python/2.7.13 Linux/4.4.51-1-lts botocore/1.5.13", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 787, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fc73fd55-452b-47e3-b69f-75a43b3cf4bf", "eventTime": "2017-02-27T22:46:09Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.255.28.91", "userAgent": "aws-cli/1.11.50 Python/2.7.13 Linux/4.4.51-1-lts botocore/1.5.13", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9c7f7271-1c59-4507-9b4b-aada1e9937fd", "record_id": "flaws_cloudtrail:0000399:9c7f7271-1c59-4507-9b4b-aada1e9937fd", "row_index": 399, "timestamp": "2017-02-27T22:49:10Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "136.195.245.225", "user_agent": "[aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 657, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9c7f7271-1c59-4507-9b4b-aada1e9937fd", "eventTime": "2017-02-27T22:49:10Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "136.195.245.225", "userAgent": "[aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f74aec0a-1b38-4929-8422-c2f74a777b91", "record_id": "flaws_cloudtrail:0000400:f74aec0a-1b38-4929-8422-c2f74a777b91", "row_index": 400, "timestamp": "2017-02-27T22:49:20Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "136.195.245.225", "user_agent": "[aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 657, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f74aec0a-1b38-4929-8422-c2f74a777b91", "eventTime": "2017-02-27T22:49:20Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "136.195.245.225", "userAgent": "[aws-cli/1.11.13 Python/3.5.2+ Linux/4.6.0-kali1-686-pae botocore/1.4.70]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bba4b492-6438-4e0a-89ce-fa43649af8fc", "record_id": "flaws_cloudtrail:0000401:bba4b492-6438-4e0a-89ce-fa43649af8fc", "row_index": 401, "timestamp": "2017-02-27T22:51:53Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "0.253.123.217", "user_agent": "aws-cli/1.11.3 Python/2.7.10 Darwin/16.4.0 botocore/1.4.61", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 768, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bba4b492-6438-4e0a-89ce-fa43649af8fc", "eventTime": "2017-02-27T22:51:53Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "0.253.123.217", "userAgent": "aws-cli/1.11.3 Python/2.7.10 Darwin/16.4.0 botocore/1.4.61", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cf2dec41-3009-4c3a-9a2e-b4961c63e075", "record_id": "flaws_cloudtrail:0000402:cf2dec41-3009-4c3a-9a2e-b4961c63e075", "row_index": 402, "timestamp": "2017-02-27T22:52:12Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "1.238.206.62", "user_agent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cf2dec41-3009-4c3a-9a2e-b4961c63e075", "eventTime": "2017-02-27T22:52:12Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "1.238.206.62", "userAgent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bc6e6798-1dc7-409d-ba03-f4e2924e9302", "record_id": "flaws_cloudtrail:0000403:bc6e6798-1dc7-409d-ba03-f4e2924e9302", "row_index": 403, "timestamp": "2017-02-27T22:52:46Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.6.135.215", "user_agent": "aws-cli/1.11.3 Python/2.7.10 Darwin/16.4.0 botocore/1.4.61", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 784, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bc6e6798-1dc7-409d-ba03-f4e2924e9302", "eventTime": "2017-02-27T22:52:46Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.6.135.215", "userAgent": "aws-cli/1.11.3 Python/2.7.10 Darwin/16.4.0 botocore/1.4.61", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "08ebd3c2-b6ed-4961-a17b-8f9aeb9c9938", "record_id": "flaws_cloudtrail:0000404:08ebd3c2-b6ed-4961-a17b-8f9aeb9c9938", "row_index": 404, "timestamp": "2017-02-27T22:53:52Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "1.238.206.62", "user_agent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "08ebd3c2-b6ed-4961-a17b-8f9aeb9c9938", "eventTime": "2017-02-27T22:53:52Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "1.238.206.62", "userAgent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9a0e5510-3cd6-461e-92d8-40e974405a1", "record_id": "flaws_cloudtrail:0000405:9a0e5510-3cd6-461e-92d8-40e974405a1", "row_index": 405, "timestamp": "2017-02-27T22:57:58Z", "event_type": "CreateVolume", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "251.6.135.215", "user_agent": "aws-cli/1.11.3 Python/2.7.10 Darwin/16.4.0 botocore/1.4.61", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 826, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9a0e5510-3cd6-461e-92d8-40e974405a1", "eventTime": "2017-02-27T22:57:58Z", "eventName": "CreateVolume", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "251.6.135.215", "userAgent": "aws-cli/1.11.3 Python/2.7.10 Darwin/16.4.0 botocore/1.4.61", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-4fd281251b99202a3", "zone": "us-west-2a"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e27a8531-d4f0-4480-b553-d86d0f248782", "record_id": "flaws_cloudtrail:0000406:e27a8531-d4f0-4480-b553-d86d0f248782", "row_index": 406, "timestamp": "2017-02-27T23:01:10Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAN4AJ104O9WZVZBR9", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "144.118.212.103", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1032, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e27a8531-d4f0-4480-b553-d86d0f248782", "eventTime": "2017-02-27T23:01:10Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "144.118.212.103", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAN4AJ104O9WZVZBR9", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-02-27T19:19:05Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logStreamName": "2017/02/27/[$LATEST]294221036b4630f8dad228b1a1db19f0", "logGroupName": "/aws/lambda/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2c59cb82-9079-4be4-a2e3-c55fd375c437", "record_id": "flaws_cloudtrail:0000407:2c59cb82-9079-4be4-a2e3-c55fd375c437", "row_index": 407, "timestamp": "2017-02-27T23:03:52Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "[aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 634, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2c59cb82-9079-4be4-a2e3-c55fd375c437", "eventTime": "2017-02-27T23:03:52Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "[aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cce569e1-0795-45c1-add7-e123d7b43c0c", "record_id": "flaws_cloudtrail:0000408:cce569e1-0795-45c1-add7-e123d7b43c0c", "row_index": 408, "timestamp": "2017-02-27T23:05:08Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "1.238.206.62", "user_agent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 767, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cce569e1-0795-45c1-add7-e123d7b43c0c", "eventTime": "2017-02-27T23:05:08Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "1.238.206.62", "userAgent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a3c3722e-6af3-4617-82fc-da75335ceabf", "record_id": "flaws_cloudtrail:0000409:a3c3722e-6af3-4617-82fc-da75335ceabf", "row_index": 409, "timestamp": "2017-02-27T23:05:24Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "1.238.206.62", "user_agent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 781, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a3c3722e-6af3-4617-82fc-da75335ceabf", "eventTime": "2017-02-27T23:05:24Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "1.238.206.62", "userAgent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "70efae0f-1891-4729-8c2d-2fb631502d17", "record_id": "flaws_cloudtrail:0000410:70efae0f-1891-4729-8c2d-2fb631502d17", "row_index": 410, "timestamp": "2017-02-27T23:07:00Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 722, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "70efae0f-1891-4729-8c2d-2fb631502d17", "eventTime": "2017-02-27T23:07:00Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3a0c33cb-e92c-4147-9596-70a9bb9b8d30", "record_id": "flaws_cloudtrail:0000411:3a0c33cb-e92c-4147-9596-70a9bb9b8d30", "row_index": 411, "timestamp": "2017-02-27T23:07:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3a0c33cb-e92c-4147-9596-70a9bb9b8d30", "eventTime": "2017-02-27T23:07:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d3b9dc5d-8d1c-4426-9648-07f3fd133601e", "record_id": "flaws_cloudtrail:0000412:d3b9dc5d-8d1c-4426-9648-07f3fd133601e", "row_index": 412, "timestamp": "2017-02-27T23:08:15Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 690, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d3b9dc5d-8d1c-4426-9648-07f3fd133601e", "eventTime": "2017-02-27T23:08:15Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "592714d-0e1d-4ec5-a985-89bbcec5ad8e", "record_id": "flaws_cloudtrail:0000413:592714d-0e1d-4ec5-a985-89bbcec5ad8e", "row_index": 413, "timestamp": "2017-02-27T23:09:12Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 721, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "592714d-0e1d-4ec5-a985-89bbcec5ad8e", "eventTime": "2017-02-27T23:09:12Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "edfd5bb6-0915-4266-b24c-50bd4442708f", "record_id": "flaws_cloudtrail:0000414:edfd5bb6-0915-4266-b24c-50bd4442708f", "row_index": 414, "timestamp": "2017-02-27T23:09:47Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "edfd5bb6-0915-4266-b24c-50bd4442708f", "eventTime": "2017-02-27T23:09:47Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8a1ee573-80d6-4b04-9ec0-8eccbf3abb53", "record_id": "flaws_cloudtrail:0000415:8a1ee573-80d6-4b04-9ec0-8eccbf3abb53", "row_index": 415, "timestamp": "2017-02-27T23:10:06Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8a1ee573-80d6-4b04-9ec0-8eccbf3abb53", "eventTime": "2017-02-27T23:10:06Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5b3763f7-08a6-4eff-8a5f-2f562053c095", "record_id": "flaws_cloudtrail:0000416:5b3763f7-08a6-4eff-8a5f-2f562053c095", "row_index": 416, "timestamp": "2017-02-27T23:10:17Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.98.10", "user_agent": "[aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17]", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 651, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5b3763f7-08a6-4eff-8a5f-2f562053c095", "eventTime": "2017-02-27T23:10:17Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.98.10", "userAgent": "[aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17]", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf02b1c1-e509-44bb-809a-6938e9662602", "record_id": "flaws_cloudtrail:0000417:bf02b1c1-e509-44bb-809a-6938e9662602", "row_index": 417, "timestamp": "2017-02-27T23:10:44Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 689, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf02b1c1-e509-44bb-809a-6938e9662602", "eventTime": "2017-02-27T23:10:44Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1243af85-87cf-4985-aca8-01410f313dbf", "record_id": "flaws_cloudtrail:0000418:1243af85-87cf-4985-aca8-01410f313dbf", "row_index": 418, "timestamp": "2017-02-27T23:11:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 687, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1243af85-87cf-4985-aca8-01410f313dbf", "eventTime": "2017-02-27T23:11:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d25b6003-032b-4090-b785-2d30cb20052", "record_id": "flaws_cloudtrail:0000419:d25b6003-032b-4090-b785-2d30cb20052", "row_index": 419, "timestamp": "2017-02-27T23:11:39Z", "event_type": "DescribeNetworkInterfaces", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d25b6003-032b-4090-b785-2d30cb20052", "eventTime": "2017-02-27T23:11:39Z", "eventName": "DescribeNetworkInterfaces", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"networkInterfaceIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2b8dc831-e1c5-4888-80d5-e40436eaeaa", "record_id": "flaws_cloudtrail:0000420:2b8dc831-e1c5-4888-80d5-e40436eaeaa", "row_index": 420, "timestamp": "2017-02-27T23:11:58Z", "event_type": "ListRoles", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.98.10", "user_agent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 839, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2b8dc831-e1c5-4888-80d5-e40436eaeaa", "eventTime": "2017-02-27T23:11:58Z", "eventName": "ListRoles", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.98.10", "userAgent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListRoles on resource: arn:aws:iam::811596193553:role/", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4e913a2d-525e-4148-9d48-62841a8a1a05", "record_id": "flaws_cloudtrail:0000421:4e913a2d-525e-4148-9d48-62841a8a1a05", "row_index": 421, "timestamp": "2017-02-27T23:12:06Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1478, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4e913a2d-525e-4148-9d48-62841a8a1a05", "eventTime": "2017-02-27T23:12:06Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAEZR5KWUB5ZZJ99SK", "expiration": "Feb 28, 2017 5:27:13 AM", "sessionToken": "FQoDYXdzEFAaDOyIYgl9wGtkSmdEZSK3A+icrl79F8yCy6m41M6TqmjzL/I/6sCYP1sFAVF2t5/Pp/fT72TQERC4gvwUsvkQgiYhsRcVE13d9lX9wOPUso6mPspYQesVRpq7X6NKwWB0cxhVCGMRMTNGZgBRitCPqJfRuMGZHTypTyuKTLO0oPwrdkikhVPOKuzTZOsgt6bOh/VQzd3edOPrAc8O465F17TwsbE9kasfALPVMdDUz+NVJgUKK0d//5XCU9Tf9UcxrBcC/qu9htJutey+835jz+qcKPzsMTo0DGp7UcVILBZHO4pJ+wJ6r9xKRKBUmNotTPKvSjb+Hye/xfcsgUkXRF9qhW6VmtUJJ0LiqOHLcQG7EBBoPZRXSziQCjFCKR5ChqeVnoB3vz9gmbZBwwOFOwHCbBx6kHmcnOi5zQs6tUZ/Ee2ylWuDVjKpjwXu26NSoxOoVzAqHw4X3+okTKy/w1FLqkxoSBKORIGLfjMtI+3EIMUehQSM5qu58ovsOHCnNZ5rAPQpLgrKzv4zrZecXkiM8Nff4yGfJX9CK+zCAbSRWYDxTm+51WdD0wA8HekV/zTPKL43+X7L7+4FIsmLXJMtCphizY8oxuTSxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "551805c6e-aa3c-448d-9462-94fe0cad96da", "record_id": "flaws_cloudtrail:0000422:551805c6e-aa3c-448d-9462-94fe0cad96da", "row_index": 422, "timestamp": "2017-02-27T23:12:33Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.98.10", "user_agent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 843, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "551805c6e-aa3c-448d-9462-94fe0cad96da", "eventTime": "2017-02-27T23:12:33Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.98.10", "userAgent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:GetUser on resource: arn:aws:iam::811596193553:user/backup", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8ce05806-9cb0-4de0-b98d-51f08a4fbe1d", "record_id": "flaws_cloudtrail:0000423:8ce05806-9cb0-4de0-b98d-51f08a4fbe1d", "row_index": 423, "timestamp": "2017-02-27T23:12:48Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 719, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8ce05806-9cb0-4de0-b98d-51f08a4fbe1d", "eventTime": "2017-02-27T23:12:48Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3df7caf5-a8fc-4125-8073-de5ef02e5623", "record_id": "flaws_cloudtrail:0000424:3df7caf5-a8fc-4125-8073-de5ef02e5623", "row_index": 424, "timestamp": "2017-02-27T23:13:41Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 668, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3df7caf5-a8fc-4125-8073-de5ef02e5623", "eventTime": "2017-02-27T23:13:41Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "41c059a8-1799-4ce8-9b60-3749b6bf7d85", "record_id": "flaws_cloudtrail:0000425:41c059a8-1799-4ce8-9b60-3749b6bf7d85", "row_index": 425, "timestamp": "2017-02-27T23:13:53Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 688, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "41c059a8-1799-4ce8-9b60-3749b6bf7d85", "eventTime": "2017-02-27T23:13:53Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2833e966-657a-4cd8-9391-732a6d8670da", "record_id": "flaws_cloudtrail:0000426:2833e966-657a-4cd8-9391-732a6d8670da", "row_index": 426, "timestamp": "2017-02-27T23:14:17Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 688, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2833e966-657a-4cd8-9391-732a6d8670da", "eventTime": "2017-02-27T23:14:17Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "202d946e-945b-4fcd-8c7b-04d238b88d83", "record_id": "flaws_cloudtrail:0000427:202d946e-945b-4fcd-8c7b-04d238b88d83", "row_index": 427, "timestamp": "2017-02-27T23:14:29Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.98.10", "user_agent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 835, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "202d946e-945b-4fcd-8c7b-04d238b88d83", "eventTime": "2017-02-27T23:14:29Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.98.10", "userAgent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListUserPolicies on resource: user backup", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9933e083-a1a8-44e7-9b92-46bf1646cc25", "record_id": "flaws_cloudtrail:0000428:9933e083-a1a8-44e7-9b92-46bf1646cc25", "row_index": 428, "timestamp": "2017-02-27T23:15:02Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 689, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9933e083-a1a8-44e7-9b92-46bf1646cc25", "eventTime": "2017-02-27T23:15:02Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f2ee45cd-f5ca-41cf-bbd7-cc5ca8000c01", "record_id": "flaws_cloudtrail:0000429:f2ee45cd-f5ca-41cf-bbd7-cc5ca8000c01", "row_index": 429, "timestamp": "2017-02-27T23:15:05Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 690, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f2ee45cd-f5ca-41cf-bbd7-cc5ca8000c01", "eventTime": "2017-02-27T23:15:05Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "389632f37-4f30-4731-958c-a4fab74c123c", "record_id": "flaws_cloudtrail:0000430:389632f37-4f30-4731-958c-a4fab74c123c", "row_index": 430, "timestamp": "2017-02-27T23:15:07Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-east-2"}, "resource_arns": [], "raw_record_size_bytes": 690, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "389632f37-4f30-4731-958c-a4fab74c123c", "eventTime": "2017-02-27T23:15:07Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-east-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fcbfdf50-4495-4f3f-88d1-b2a155fb5110", "record_id": "flaws_cloudtrail:0000431:fcbfdf50-4495-4f3f-88d1-b2a155fb5110", "row_index": 431, "timestamp": "2017-02-27T23:15:15Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fcbfdf50-4495-4f3f-88d1-b2a155fb5110", "eventTime": "2017-02-27T23:15:15Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ecb9d7d0-ecc2-4cdd-995a-0d5777f2b716", "record_id": "flaws_cloudtrail:0000432:ecb9d7d0-ecc2-4cdd-995a-0d5777f2b716", "row_index": 432, "timestamp": "2017-02-27T23:15:18Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ecb9d7d0-ecc2-4cdd-995a-0d5777f2b716", "eventTime": "2017-02-27T23:15:18Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e3fffe7f-d033-49ff-994d-ecbd375f3377", "record_id": "flaws_cloudtrail:0000433:e3fffe7f-d033-49ff-994d-ecbd375f3377", "row_index": 433, "timestamp": "2017-02-27T23:15:29Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e3fffe7f-d033-49ff-994d-ecbd375f3377", "eventTime": "2017-02-27T23:15:29Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "13d601b6-c719-489b-8c46-b7722a8d45eb", "record_id": "flaws_cloudtrail:0000434:13d601b6-c719-489b-8c46-b7722a8d45eb", "row_index": 434, "timestamp": "2017-02-27T23:15:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.98.10", "user_agent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 758, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "13d601b6-c719-489b-8c46-b7722a8d45eb", "eventTime": "2017-02-27T23:15:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.98.10", "userAgent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f1f47541-4708-4039-967c-e440ed1335a7", "record_id": "flaws_cloudtrail:0000435:f1f47541-4708-4039-967c-e440ed1335a7", "row_index": 435, "timestamp": "2017-02-27T23:15:35Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.98.10", "user_agent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f1f47541-4708-4039-967c-e440ed1335a7", "eventTime": "2017-02-27T23:15:35Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.98.10", "userAgent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiI4c2ZYZWxTNGsrNTJDUW13Z1RpNE5EeXMxTmJVUDBqSEF6Mk5LV3ZpbmtIMGJRdFBoMmUxYS9UWTF4bDFjd3NrRXZhL2pXbmlFYnlCWTdsYytoYjkzZHpQRXZMTzZpVlFVYVloREc1Vm9XTlliQ2gxM0dWK0RXNUd5NGFyOEdkMzlpRktYZmo2UXU3YWNsR0hrOTBIWUE9PSIsImkiOiJaWkVpM3luQjdRZHg3RFNUbko4anl3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e95fb05e-9812-4490-b9c5-3191fa3d422a", "record_id": "flaws_cloudtrail:0000436:e95fb05e-9812-4490-b9c5-3191fa3d422a", "row_index": 436, "timestamp": "2017-02-27T23:15:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.98.10", "user_agent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e95fb05e-9812-4490-b9c5-3191fa3d422a", "eventTime": "2017-02-27T23:15:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.98.10", "userAgent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJBdEtEMnRTY1hkajh4R1htUW92eGJEaUxVM25zSXQrUjRBa1ExclZxQnhOOEZvL0V1L1QvYUlBVjlVY05aYzMyUjJRTDJ1d1NId290RlEzNGVCTVlNNERuK05BUW50UUl1ZkZCQWN2TlQ2SkZhWGJLRE5TaUxsMWlZZDRuV0I3NUNFRmQwWWNzT2o1QklST3dyRSsxVGc9PSIsImkiOiJRMmtNT2FmaTdMaGRiWDkxV1ZxaUp3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4c056683-eb48-4bc0-b883-8245f92996bb", "record_id": "flaws_cloudtrail:0000437:4c056683-eb48-4bc0-b883-8245f92996bb", "row_index": 437, "timestamp": "2017-02-27T23:15:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.98.10", "user_agent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4c056683-eb48-4bc0-b883-8245f92996bb", "eventTime": "2017-02-27T23:15:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.98.10", "userAgent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJORk5FU01Zejdtckl3bzBYaENHOW51NDkrcEtHaTl1SjM5NXRwZThYZ1BnMU5lYUVUcGQzY3RzbFZ0dXNaOWlpcjJ1WWFDcHV4NnB5czBIWFp3SmI5b1N0aTRYSTA3b1FvZkM0TXlBbFNoLzlEOG1jVWRydEtVWmR3NW9ZcEZ2YWRYU1h0MzkxVjVuQlNoeWw1V3AzQmc9PSIsImkiOiJKTHdYbzBRQjQ0NlEzWnIyTkNvTW9BPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "38b66825-51fd-4fb6-99e7-10ac6c98c347", "record_id": "flaws_cloudtrail:0000438:38b66825-51fd-4fb6-99e7-10ac6c98c347", "row_index": 438, "timestamp": "2017-02-27T23:15:44Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "38b66825-51fd-4fb6-99e7-10ac6c98c347", "eventTime": "2017-02-27T23:15:44Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "833d54df-d375-428f-9c2c-076b2ae2c20e", "record_id": "flaws_cloudtrail:0000439:833d54df-d375-428f-9c2c-076b2ae2c20e", "row_index": 439, "timestamp": "2017-02-27T23:16:32Z", "event_type": "DescribeReservedInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-1"}, "resource_arns": [], "raw_record_size_bytes": 705, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "833d54df-d375-428f-9c2c-076b2ae2c20e", "eventTime": "2017-02-27T23:16:32Z", "eventName": "DescribeReservedInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"reservedInstancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "277446a-ef90-4bed-adc3-d99315b630fc", "record_id": "flaws_cloudtrail:0000440:277446a-ef90-4bed-adc3-d99315b630fc", "row_index": 440, "timestamp": "2017-02-27T23:16:34Z", "event_type": "DescribeReservedInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 704, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "277446a-ef90-4bed-adc3-d99315b630fc", "eventTime": "2017-02-27T23:16:34Z", "eventName": "DescribeReservedInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"reservedInstancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c4a2d388-0301-41f6-b3f1-2407dc4de14f", "record_id": "flaws_cloudtrail:0000441:c4a2d388-0301-41f6-b3f1-2407dc4de14f", "row_index": 441, "timestamp": "2017-02-27T23:16:47Z", "event_type": "DescribeSpotInstanceRequests", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 712, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c4a2d388-0301-41f6-b3f1-2407dc4de14f", "eventTime": "2017-02-27T23:16:47Z", "eventName": "DescribeSpotInstanceRequests", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"spotInstanceRequestIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "294a9048-ade8-4975-8fb5-e82dafaca5c7", "record_id": "flaws_cloudtrail:0000442:294a9048-ade8-4975-8fb5-e82dafaca5c7", "row_index": 442, "timestamp": "2017-02-27T23:16:56Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.98.10", "user_agent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 772, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "294a9048-ade8-4975-8fb5-e82dafaca5c7", "eventTime": "2017-02-27T23:16:56Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.98.10", "userAgent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b6d84f23-7275-4710-bb43-865a00cf7862", "record_id": "flaws_cloudtrail:0000443:b6d84f23-7275-4710-bb43-865a00cf7862", "row_index": 443, "timestamp": "2017-02-27T23:17:26Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.98.10", "user_agent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 792, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b6d84f23-7275-4710-bb43-865a00cf7862", "eventTime": "2017-02-27T23:17:26Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.98.10", "userAgent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bc738d16-0359-46d3-9fad-32f6ce23c46e", "record_id": "flaws_cloudtrail:0000444:bc738d16-0359-46d3-9fad-32f6ce23c46e", "row_index": 444, "timestamp": "2017-02-27T23:17:37Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 687, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bc738d16-0359-46d3-9fad-32f6ce23c46e", "eventTime": "2017-02-27T23:17:37Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6d20c1b2-75c5-436b-9418-a523d4c259b9", "record_id": "flaws_cloudtrail:0000445:6d20c1b2-75c5-436b-9418-a523d4c259b9", "row_index": 445, "timestamp": "2017-02-27T23:18:25Z", "event_type": "DescribeRegions", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 669, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6d20c1b2-75c5-436b-9418-a523d4c259b9", "eventTime": "2017-02-27T23:18:25Z", "eventName": "DescribeRegions", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"regionSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "78eef8b4-f19d-48f2-9a25-ba5581aeae2f", "record_id": "flaws_cloudtrail:0000446:78eef8b4-f19d-48f2-9a25-ba5581aeae2f", "row_index": 446, "timestamp": "2017-02-27T23:18:39Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 689, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "78eef8b4-f19d-48f2-9a25-ba5581aeae2f", "eventTime": "2017-02-27T23:18:39Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2590dab0-3746-418c-abe6-5fde148f13fc", "record_id": "flaws_cloudtrail:0000447:2590dab0-3746-418c-abe6-5fde148f13fc", "row_index": 447, "timestamp": "2017-02-27T23:18:45Z", "event_type": "DescribeVpcs", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 678, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2590dab0-3746-418c-abe6-5fde148f13fc", "eventTime": "2017-02-27T23:18:45Z", "eventName": "DescribeVpcs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"vpcSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bc31799a-9c7a-46eb-8c8f-c12727b518f5", "record_id": "flaws_cloudtrail:0000448:bc31799a-9c7a-46eb-8c8f-c12727b518f5", "row_index": 448, "timestamp": "2017-02-27T23:19:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.98.10", "user_agent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 758, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bc31799a-9c7a-46eb-8c8f-c12727b518f5", "eventTime": "2017-02-27T23:19:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.98.10", "userAgent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c2bbf1cf-283b-4712-82a7-43843bdada", "record_id": "flaws_cloudtrail:0000449:c2bbf1cf-283b-4712-82a7-43843bdada", "row_index": 449, "timestamp": "2017-02-27T23:19:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.98.10", "user_agent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c2bbf1cf-283b-4712-82a7-43843bdada", "eventTime": "2017-02-27T23:19:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.98.10", "userAgent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJRbjVGQkg4dnhGZXJibjhqQWlEV3grT0tmeXJ4R3E1eE4xZFhtbyttT2VwNmFwUjhIbzBkS3o5aWFXQXhSZXM3VkdJSmRvUkFBQ01wWWJTQS9meXZZckYrOFdhbVRHOHVkcmNockNRdVMzY1lQNjl0dk9vRWw4VmM0UnJ5b3kwQWQ5YVpmOHQ2bDlhNVkwajBWbUJLNWc9PSIsImkiOiJPUzRLTWdXbkQxejc2NlMvaXdEYjN3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0436ad98-719f-4fe6-bd6d-afb90382fd81", "record_id": "flaws_cloudtrail:0000450:0436ad98-719f-4fe6-bd6d-afb90382fd81", "row_index": 450, "timestamp": "2017-02-27T23:19:16Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.98.10", "user_agent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0436ad98-719f-4fe6-bd6d-afb90382fd81", "eventTime": "2017-02-27T23:19:16Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.98.10", "userAgent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiI2ZEg1WWpGNHNEV3o3N1U2SDdjZVNzYzlqcW1OSlNYTXArUDVhcUo2UlVQb201Zkx3TFllRnFHQWt5TE9ISDBaclZ0WUhXV0s1SmRnZGxpSnlTQW83bFNXcGdFWkFNRWZSUEtmYUYvZC9IQ3psWjdPaGhjYXJ6dlZkSEtZS3FkdWdSdUcwMnN5REhmTXJzdkFMUWlNb2c9PSIsImkiOiJ1L2VTelh6NkltM1hnd3hBZ3E4SVFBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "becba0f4-bd14-46ae-aed1-d673d4d980190", "record_id": "flaws_cloudtrail:0000451:becba0f4-bd14-46ae-aed1-d673d4d980190", "row_index": 451, "timestamp": "2017-02-27T23:19:17Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.98.10", "user_agent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "aws_region": "ap-southeast-2"}, "resource_arns": [], "raw_record_size_bytes": 1051, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "becba0f4-bd14-46ae-aed1-d673d4d980190", "eventTime": "2017-02-27T23:19:17Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.98.10", "userAgent": "aws-cli/1.11.54 Python/2.7.12 Linux/4.9.8-moby botocore/1.5.17", "awsRegion": "ap-southeast-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMSIsImMiOiJHN2MwOEIxa2t4K3ZNMlhuVDg4Y3IvcmRENFMxSGVOUExXMXczVjdNLzkrTFRUWkdZdXRzYWhVSHJuQ3VxR0FrSUc2a1lja24wYlFkeGdzREJwUXJaNjlNa3dPYktLUXpmV2NCZHc3bUdNR0ZicEdlUmV2RS81NkxJNmZRTUJUeE1hUDRYNGVBT282ZlphNWdzcWxvSlE9PSIsImkiOiJHbVdrQ09Jd3lOajlNYk92UXBwNzR3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "58bd3863-ef16-4cf6-afb6-5bddeb78e7e6", "record_id": "flaws_cloudtrail:0000452:58bd3863-ef16-4cf6-afb6-5bddeb78e7e6", "row_index": 452, "timestamp": "2017-02-27T23:19:21Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 666, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "58bd3863-ef16-4cf6-afb6-5bddeb78e7e6", "eventTime": "2017-02-27T23:19:21Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "73cc2053-5510-4fb6-9736-06c626e8d874", "record_id": "flaws_cloudtrail:0000453:73cc2053-5510-4fb6-9736-06c626e8d874", "row_index": 453, "timestamp": "2017-02-27T23:19:44Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "73cc2053-5510-4fb6-9736-06c626e8d874", "eventTime": "2017-02-27T23:19:44Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aa699fc2-f6fd-4fee-81fd-5bf5106629bc", "record_id": "flaws_cloudtrail:0000454:aa699fc2-f6fd-4fee-81fd-5bf5106629bc", "row_index": 454, "timestamp": "2017-02-27T23:19:57Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 663, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aa699fc2-f6fd-4fee-81fd-5bf5106629bc", "eventTime": "2017-02-27T23:19:57Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "67b04be7-bd3f-4a93-8c07-d08b89928c9", "record_id": "flaws_cloudtrail:0000455:67b04be7-bd3f-4a93-8c07-d08b89928c9", "row_index": 455, "timestamp": "2017-02-27T23:20:10Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 683, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "67b04be7-bd3f-4a93-8c07-d08b89928c9", "eventTime": "2017-02-27T23:20:10Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "92235c-fcd7-4f94-a31d-fa9192cd80be", "record_id": "flaws_cloudtrail:0000456:92235c-fcd7-4f94-a31d-fa9192cd80be", "row_index": 456, "timestamp": "2017-02-27T23:21:01Z", "event_type": "DescribeInstanceStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 766, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "92235c-fcd7-4f94-a31d-fa9192cd80be", "eventTime": "2017-02-27T23:21:01Z", "eventName": "DescribeInstanceStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"instanceId": "i-aa2d3b42e5c6e801a"}]}, "filterSet": {}, "includeAllInstances": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b84369-5fde-41ad-884e-1d90a0a56615", "record_id": "flaws_cloudtrail:0000457:b84369-5fde-41ad-884e-1d90a0a56615", "row_index": 457, "timestamp": "2017-02-27T23:21:13Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 733, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b84369-5fde-41ad-884e-1d90a0a56615", "eventTime": "2017-02-27T23:21:13Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"instancesSet": {"items": [{"instanceId": "i-aa2d3b42e5c6e801a"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "180d2260-c45e-4856-9b38-0d9d69aca704", "record_id": "flaws_cloudtrail:0000458:180d2260-c45e-4856-9b38-0d9d69aca704", "row_index": 458, "timestamp": "2017-02-27T23:21:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "180d2260-c45e-4856-9b38-0d9d69aca704", "eventTime": "2017-02-27T23:21:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fca5e30d-9d00-4a7a-ac9c-7b2fa187fef3", "record_id": "flaws_cloudtrail:0000459:fca5e30d-9d00-4a7a-ac9c-7b2fa187fef3", "row_index": 459, "timestamp": "2017-02-27T23:22:06Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 666, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fca5e30d-9d00-4a7a-ac9c-7b2fa187fef3", "eventTime": "2017-02-27T23:22:06Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b6a3c3ec-5038-4df9-a5c3-8bd78d3bccd5", "record_id": "flaws_cloudtrail:0000460:b6a3c3ec-5038-4df9-a5c3-8bd78d3bccd5", "row_index": 460, "timestamp": "2017-02-27T23:22:17Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "223.53.255.252", "user_agent": "[aws-cli/1.11.42 Python/2.7.10 Darwin/16.1.0 botocore/1.5.5]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 606, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b6a3c3ec-5038-4df9-a5c3-8bd78d3bccd5", "eventTime": "2017-02-27T23:22:17Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "223.53.255.252", "userAgent": "[aws-cli/1.11.42 Python/2.7.10 Darwin/16.1.0 botocore/1.5.5]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b6b212431-df2c-47ed-b77d-3dda61348d9d", "record_id": "flaws_cloudtrail:0000461:b6b212431-df2c-47ed-b77d-3dda61348d9d", "row_index": 461, "timestamp": "2017-02-27T23:23:36Z", "event_type": "CopySnapshot", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.239.132.95", "user_agent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1356, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b6b212431-df2c-47ed-b77d-3dda61348d9d", "eventTime": "2017-02-27T23:23:36Z", "eventName": "CopySnapshot", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.239.132.95", "userAgent": "aws-cli/1.7.36 Python/2.7.11 Linux/4.4.0-34-generic", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"sourceRegion": "us-west-2", "sourceSnapshotId": "snap-4fd281251b99202a3", "description": "copying", "destinationRegion": "us-west-2", "presignedUrl": "https://ec2.us-west-2.amazonaws.com/?SourceRegion=us-west-2&SourceSnapshotId=snap-4fd281251b99202a3&Version=2015-04-15&Description=copying&Action=CopySnapshot&DestinationRegion=us-west-2&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=3600&X-Amz-Credential=AKIA1ZBTOEKWKVHP6GHZ%2F172111%2Fus-west-2%2Fec2%2Faws4_request&X-Amz-SignedHeaders=host&X-Amz-Date=172111T50193Z&X-Amz-Signature=0f1eceb8733c78738443f70c6554022809f27d81ccce39ece8a5d6e0ae59bdd9"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9c34da0a-82e7-4c24-94cc-f6e34ebf5f73", "record_id": "flaws_cloudtrail:0000462:9c34da0a-82e7-4c24-94cc-f6e34ebf5f73", "row_index": 462, "timestamp": "2017-02-27T23:23:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "223.53.255.252", "user_agent": "aws-cli/1.11.42 Python/2.7.10 Darwin/16.1.0 botocore/1.5.5", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 750, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9c34da0a-82e7-4c24-94cc-f6e34ebf5f73", "eventTime": "2017-02-27T23:23:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "223.53.255.252", "userAgent": "aws-cli/1.11.42 Python/2.7.10 Darwin/16.1.0 botocore/1.5.5", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "467f9e35-32dc-41e6-94e8-23d8cc34d9dc", "record_id": "flaws_cloudtrail:0000463:467f9e35-32dc-41e6-94e8-23d8cc34d9dc", "row_index": 463, "timestamp": "2017-02-27T23:23:40Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "223.53.255.252", "user_agent": "aws-cli/1.11.42 Python/2.7.10 Darwin/16.1.0 botocore/1.5.5", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "467f9e35-32dc-41e6-94e8-23d8cc34d9dc", "eventTime": "2017-02-27T23:23:40Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "223.53.255.252", "userAgent": "aws-cli/1.11.42 Python/2.7.10 Darwin/16.1.0 botocore/1.5.5", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4dDI0TkVWQUpwNnlmd3J3d1lBa0VDSFg0Z09FOXJiTU5zQXNaaUlEREUxU2F6Ykc1YjJ3c1YyRTA4Zi9iRlBMRDV0MzRSYXFYbE9TdCtaYjM2Uy8rWDFIbFFhTXk3WVQzc2lJbjdkODk3SUhCVFFyZXZURmFNcjE2bW40T29ZN2h3dEVKV2dpdHd0UU5KRi8zeDA1ZEI3aGN1YURTMUF3TW50NWx2N3RGNnlxM1h4bjJsWmpLSCs2a1dIViIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "355212fda-464a-455c-8894-549ac2154d94", "record_id": "flaws_cloudtrail:0000464:355212fda-464a-455c-8894-549ac2154d94", "row_index": 464, "timestamp": "2017-02-27T23:23:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "223.53.255.252", "user_agent": "aws-cli/1.11.42 Python/2.7.10 Darwin/16.1.0 botocore/1.5.5", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "355212fda-464a-455c-8894-549ac2154d94", "eventTime": "2017-02-27T23:23:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "223.53.255.252", "userAgent": "aws-cli/1.11.42 Python/2.7.10 Darwin/16.1.0 botocore/1.5.5", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJMRHdSdUJIZzR6T2FqbkFHODllbzdNR0l3elMxKy9IR3Q0d1hpZFpiSXJpRE9GTTRFcm9wYitjSUNZcFZtejMwTi8rZE5rN1ljeE9mZldpbTEzV01nZ2Uxc0J2aHo1ZEN3QmpVOENpNHQrVHBXZFVEMUl5M1MrYXBveVB4WXZWK3dscG1XbmJjYWppVVFObDFlV3pqMjR0STFhYndpRDRZNTcwdjJLQThrbEpGZlNxV2FKSUdLKy9pL3lmMCIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "85b2811c-9a44-4a02-bac2-307d3a956d32", "record_id": "flaws_cloudtrail:0000465:85b2811c-9a44-4a02-bac2-307d3a956d32", "row_index": 465, "timestamp": "2017-02-27T23:23:45Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "223.53.255.252", "user_agent": "aws-cli/1.11.42 Python/2.7.10 Darwin/16.1.0 botocore/1.5.5", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "85b2811c-9a44-4a02-bac2-307d3a956d32", "eventTime": "2017-02-27T23:23:45Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "223.53.255.252", "userAgent": "aws-cli/1.11.42 Python/2.7.10 Darwin/16.1.0 botocore/1.5.5", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJpV2JQU2FGZ3lDb3hlendUNFUycHhLRjMwajIrbk9oR004TFZnYTQ1V1dLQjNKbnY2cTRQRlJ4dmt2NXBBS3hMelAwZGxkbGxSdUhtaWZuTnA0eHJ1L1dMRXl5NVN5L2V2bUlldFRMK01iVW5mSStpNThxSGR0L2xQRnEvckFPTlEveUdZeFc2VXRlWlp4dDREYXZJd1M1R0thaFN0eEFsL01rTXFTT0orekJyYzZFbjFTeFVVTSsyRlFBPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "78b3190b-1630-43c5-84b5-c50404de073d", "record_id": "flaws_cloudtrail:0000466:78b3190b-1630-43c5-84b5-c50404de073d", "row_index": 466, "timestamp": "2017-02-27T23:23:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "223.53.255.252", "user_agent": "aws-cli/1.11.42 Python/2.7.10 Darwin/16.1.0 botocore/1.5.5", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1050, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "78b3190b-1630-43c5-84b5-c50404de073d", "eventTime": "2017-02-27T23:23:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "223.53.255.252", "userAgent": "aws-cli/1.11.42 Python/2.7.10 Darwin/16.1.0 botocore/1.5.5", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJZNVZGUWFyc2xBNk9CQkdkQ1BRc3JydURQdVVsYjlDUEhPc0E2eFRQTGI2WUc3OVZnQlNWRis2K3FQc2pXU2R1L2RBa0Q0Nm5WMUxHZzFqdFlhbXNGUUsyVE54SjJPZGtnUkE2TTNYbXB0ODFsVm11K3psYm1uUGM0Ujk4eXRqSHFIOHFUQXREaG5oTEVIZFMrWmo4ODZmeTBmU24yQTVYYzJMRVFOVmhPY1V0NGlLeFdZWHgxanYzMnBFPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "875dca48-149b-44e7-a339-3a9d778e592b", "record_id": "flaws_cloudtrail:0000467:875dca48-149b-44e7-a339-3a9d778e592b", "row_index": 467, "timestamp": "2017-02-27T23:23:50Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "223.53.255.252", "user_agent": "aws-cli/1.11.42 Python/2.7.10 Darwin/16.1.0 botocore/1.5.5", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1053, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "875dca48-149b-44e7-a339-3a9d778e592b", "eventTime": "2017-02-27T23:23:50Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "223.53.255.252", "userAgent": "aws-cli/1.11.42 Python/2.7.10 Darwin/16.1.0 botocore/1.5.5", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI4UklEYm1YRmZCa0EvNitmVXY5N2NKYkNrUlVINkg0UjZGRGdzaENzL1VkdDRQVnNmVmd6dXlUMzVST0dKMWFzVk9FWDdrczV1Tno2Y2Q4VFBGd0k2enM4VC9WUmJzeDZHYUdPKy9Janp0ckYveTlRdmZ3L3Y3MjlzNFhnejlIUCtkNDRESjlxeE9PVkRMekZCOWpSUlYwRGZIUHF5YnpacFhaaFdkWitiRk9sRVVUVCtlbThiV3g5a2pyMWhBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "978e1ffb-a584-4f45-a3d6-7e27d63bc31a", "record_id": "flaws_cloudtrail:0000468:978e1ffb-a584-4f45-a3d6-7e27d63bc31a", "row_index": 468, "timestamp": "2017-02-27T23:23:52Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "223.53.255.252", "user_agent": "aws-cli/1.11.42 Python/2.7.10 Darwin/16.1.0 botocore/1.5.5", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "978e1ffb-a584-4f45-a3d6-7e27d63bc31a", "eventTime": "2017-02-27T23:23:52Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "223.53.255.252", "userAgent": "aws-cli/1.11.42 Python/2.7.10 Darwin/16.1.0 botocore/1.5.5", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJyMlE0MWVucHRCTzU2S2xUWVdGQlBBR1Z6OExGR29HTkVta0UwMlcwY3VTYmhhY1VlQjNrYVJJQU54Z2RVWlBiQ2tWSzJYRlZrNEc3QnVYbEpEOGJUWmZUekN0WmJWQWJObzYyR3RlL0t3TEVIblVqYlFDS3JaQWpBbWZZZXBuRVdPZVhFYlBhVDhmcE1wdjlqVFdFMDNyRWRNYVdrWm9xRFRPTko2S0FsajBqZjk3NldhTk5JejNDMHRFNyIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8ba95b13-9730-4909-b9b9-28694cf8ec3a", "record_id": "flaws_cloudtrail:0000469:8ba95b13-9730-4909-b9b9-28694cf8ec3a", "row_index": 469, "timestamp": "2017-02-27T23:23:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "223.53.255.252", "user_agent": "aws-cli/1.11.42 Python/2.7.10 Darwin/16.1.0 botocore/1.5.5", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1049, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8ba95b13-9730-4909-b9b9-28694cf8ec3a", "eventTime": "2017-02-27T23:23:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "223.53.255.252", "userAgent": "aws-cli/1.11.42 Python/2.7.10 Darwin/16.1.0 botocore/1.5.5", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI2V0hMUzNLb3VVamhyeDgxd25FU0NGSzJYUGZZTmQ2QkF4dHVYdXlPQjBGT0N4ajJkMXUva0REbjNFSnVqR09idEFHTmszTE1Ca01GSkRyL25teXpvRFRsY3dOcUhHUHFTNk1GdzhiajJ2NHZhdnN2RWNQVEg2Nkt5eTlwaUExczErQzlFZlU5T3ZXMmZFbTlpczlqL1BtYkFubFlMdEY2OVhwdmlTN2k0WGI5VW1XR0hQVWcyY1BkSjlnPSIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c80362a2-3a17-4613-b2d6-6d07078fea1", "record_id": "flaws_cloudtrail:0000470:c80362a2-3a17-4613-b2d6-6d07078fea1", "row_index": 470, "timestamp": "2017-02-27T23:23:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "223.53.255.252", "user_agent": "aws-cli/1.11.42 Python/2.7.10 Darwin/16.1.0 botocore/1.5.5", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1048, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c80362a2-3a17-4613-b2d6-6d07078fea1", "eventTime": "2017-02-27T23:23:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "223.53.255.252", "userAgent": "aws-cli/1.11.42 Python/2.7.10 Darwin/16.1.0 botocore/1.5.5", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI2dlltSk5Xc2prQ0lqQzB1dXNsNFBlMWdsbXdyRmZiY0UwQzhtZlR4eHFvYUpZNU9hUE8zUkFPN3E3NXVTY0NlRmU2akpDL292ZCsrMjFMZTBJWVFDT0V4T1lZMlZIMlJhL1lWQ2JpMVlDc2IvVEFPejU5TDhhYmpzelVGdE8rMFQveE02ZUVzdGxKYVc0SGdyUmhSQVhKWkVoeFRLdmZhL3F4SzhpVFN3S0tjTVhYZVJNSERrclRvTUZaVCIsInMiOiIxIn0=", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac7cd0f0-0633-4575-b55a-e5d39e7b0b65", "record_id": "flaws_cloudtrail:0000471:ac7cd0f0-0633-4575-b55a-e5d39e7b0b65", "row_index": 471, "timestamp": "2017-02-27T23:24:23Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.238.24.236", "user_agent": "[aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 644, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac7cd0f0-0633-4575-b55a-e5d39e7b0b65", "eventTime": "2017-02-27T23:24:23Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.238.24.236", "userAgent": "[aws-cli/1.11.55 Python/2.7.10 Darwin/16.4.0 botocore/1.5.18]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "086a7be0-0cc4-4da6-981e-f0ac298863bb", "record_id": "flaws_cloudtrail:0000472:086a7be0-0cc4-4da6-981e-f0ac298863bb", "row_index": 472, "timestamp": "2017-02-27T23:24:27Z", "event_type": "DescribeImportSnapshotTasks", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "ASIAPHDGJHJRBLGG9DMR", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2-frontend-api.amazonaws.com", "user_agent": "ec2-frontend-api.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "086a7be0-0cc4-4da6-981e-f0ac298863bb", "eventTime": "2017-02-27T23:24:27Z", "eventName": "DescribeImportSnapshotTasks", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2-frontend-api.amazonaws.com", "userAgent": "ec2-frontend-api.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "ASIAPHDGJHJRBLGG9DMR", "userName": "backup", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-02-27T23:24:26Z"}}, "invokedBy": "ec2-frontend-api.amazonaws.com"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "658a018f-9f3a-4b2a-b429-01e474021f4a5", "record_id": "flaws_cloudtrail:0000473:658a018f-9f3a-4b2a-b429-01e474021f4a5", "row_index": 473, "timestamp": "2017-02-27T23:26:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "1.238.206.62", "user_agent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "658a018f-9f3a-4b2a-b429-01e474021f4a5", "eventTime": "2017-02-27T23:26:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "1.238.206.62", "userAgent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0375bc0a-8ea9-4ef4-8f94-20260bca", "record_id": "flaws_cloudtrail:0000474:0375bc0a-8ea9-4ef4-8f94-20260bca", "row_index": 474, "timestamp": "2017-02-27T23:27:31Z", "event_type": "CreateVolume", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "1.238.206.62", "user_agent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 822, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0375bc0a-8ea9-4ef4-8f94-20260bca", "eventTime": "2017-02-27T23:27:31Z", "eventName": "CreateVolume", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "1.238.206.62", "userAgent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-4fd281251b99202a3", "zone": "us-west-2b"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "20152-72cc-4adc-9561-13754b15fa", "record_id": "flaws_cloudtrail:0000475:20152-72cc-4adc-9561-13754b15fa", "row_index": 475, "timestamp": "2017-02-27T23:27:58Z", "event_type": "CreateVolume", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "1.238.206.62", "user_agent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 819, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "20152-72cc-4adc-9561-13754b15fa", "eventTime": "2017-02-27T23:27:58Z", "eventName": "CreateVolume", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "1.238.206.62", "userAgent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-4fd281251b99202a3", "zone": "us-west-2b"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "34038ca-0e50-4a7d-915c-04ea96553a39", "record_id": "flaws_cloudtrail:0000476:34038ca-0e50-4a7d-915c-04ea96553a39", "row_index": 476, "timestamp": "2017-02-27T23:59:20Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "1.238.206.62", "user_agent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 764, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "34038ca-0e50-4a7d-915c-04ea96553a39", "eventTime": "2017-02-27T23:59:20Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "1.238.206.62", "userAgent": "aws-cli/1.11.45 Python/2.7.13 Darwin/15.6.0 botocore/1.5.8", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8bac579e-50af-4bbc-86c4-d9e6f3b8e1ec", "record_id": "flaws_cloudtrail:0000477:8bac579e-50af-4bbc-86c4-d9e6f3b8e1ec", "row_index": 477, "timestamp": "2017-02-28T00:13:17Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1478, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8bac579e-50af-4bbc-86c4-d9e6f3b8e1ec", "eventTime": "2017-02-28T00:13:17Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA7TAB2PD417KLUEHG", "expiration": "Feb 28, 2017 6:23:14 AM", "sessionToken": "FQoDYXdzEFEaDAqnRxx0nSW9Oe8VQCK3AwoC3g9ewUY2KLwnOGl+M6m0iuJ1/O4XooRS8x29PHlJXB5H8qrnifs7eNh1WHbVN5Fl3sl+E4ePslXXvqX4TXI1Ykrqw3Hww0l6ueiwhrfBGRedYADuxTOUsd0kouyF8XMJAxCc4+m/q92A4AbJSQV4qgh8nAM9cGPRn8yn0znYdHQ1oKWjZd6k65J+obztCj3j28aPIGnvomDQyfR1YcIzYspH9PjXVjhB38SW/gBT1gYcm6CEsjRATrAELuvNyn9iHfFKlEMCe2IGUkUcy3JqE05iOTUO5/62aXlmYc55HyA/SI6nWYNht9MrMs9gBNJQr9+NEuHRuGYHOjTNKG3GVSYfv7PJucVUnRzA8ImRZtLPE3KP7/h/VSkK7R0Mo+ku4ROtQB4CoIHp180mNF2KyBOSLM8A+KtXBvlVTMPEJxONqra9nDAsdqZPkf6SD+1vIO56zjXTyUP6Kf3UeYerItFJ7dYVDbc1wDICmvAZC8Ojm8/o9lLHv5NxXd/pZMxDGAAEYBOX3oou/0U+vxyI6XlGnLV/KFGit1Qqb/5J5yCdn8YOD0FGtM5Uh4sHAAxozfQ/CB4onYHTxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "319bf12a-9517-4d1a-9454-d152957e3c4c", "record_id": "flaws_cloudtrail:0000478:319bf12a-9517-4d1a-9454-d152957e3c4c", "row_index": 478, "timestamp": "2017-02-28T01:09:43Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-cli/1.11.47 Python/2.7.3 Linux/3.2.0-4-amd64 botocore/1.5.10", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 776, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "319bf12a-9517-4d1a-9454-d152957e3c4c", "eventTime": "2017-02-28T01:09:43Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-cli/1.11.47 Python/2.7.3 Linux/3.2.0-4-amd64 botocore/1.5.10", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7eea3a04-9e4b-4180-bb3d-bb4367b328aa", "record_id": "flaws_cloudtrail:0000479:7eea3a04-9e4b-4180-bb3d-bb4367b328aa", "row_index": 479, "timestamp": "2017-02-28T01:09:59Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-cli/1.11.47 Python/2.7.3 Linux/3.2.0-4-amd64 botocore/1.5.10", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 791, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7eea3a04-9e4b-4180-bb3d-bb4367b328aa", "eventTime": "2017-02-28T01:09:59Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-cli/1.11.47 Python/2.7.3 Linux/3.2.0-4-amd64 botocore/1.5.10", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a3a08972-4a3f-4296-a14a-8d9e97e5126d", "record_id": "flaws_cloudtrail:0000480:a3a08972-4a3f-4296-a14a-8d9e97e5126d", "row_index": 480, "timestamp": "2017-02-28T01:11:54Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-cli/1.11.47 Python/2.7.3 Linux/3.2.0-4-amd64 botocore/1.5.10", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 776, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a3a08972-4a3f-4296-a14a-8d9e97e5126d", "eventTime": "2017-02-28T01:11:54Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-cli/1.11.47 Python/2.7.3 Linux/3.2.0-4-amd64 botocore/1.5.10", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "324d0d13-c94a-48c9-a09c-a141b56a5954", "record_id": "flaws_cloudtrail:0000481:324d0d13-c94a-48c9-a09c-a141b56a5954", "row_index": 481, "timestamp": "2017-02-28T01:13:45Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1478, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "324d0d13-c94a-48c9-a09c-a141b56a5954", "eventTime": "2017-02-28T01:13:45Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAMWXEY675LJ6P96O9", "expiration": "Feb 28, 2017 7:41:14 AM", "sessionToken": "FQoDYXdzEFIaDD47NKHs5nrRqKMTkSK3A+++KMEwoTAFzAUa002lM4Iyc8TbMC/I9XsyVzH92ZWWbOfWugrUPrSJD3SrRY7fB5ngLH8GyDzfXX4GldJNafJ0NZken/fpAso2nPt7bLei0+MoR5p34azDF4jjvBeAGewIrikpNG7YsdPXC7CBN0MEIEZ4tevfTiGEnAW+hHn25m7SV7sNBkUb8BOrtsPWmNCVl4O373UxASHxgVnV08GcO5YPR+4NZ1wcXq0K863JlIdgxpkC4Q4JnG5yVp/i1YqX3JG0/xvGJLjLl1EO0uZvBm+9gMKBQzQTjfqqu2F/wDDr/bJyJGpVC91TXM9i3re9Il9FHo7/g2eX4nN1sdGWw4/D52Vb1hI0oBpqVG+LxYvwEUBHlp6KlgF4jVkGlV61YAgfGlVKDlW+qHqyLXMD09zFEplWrhbCGcwUvi/vVCXX1FXpGbdE0MnpzOd3vL35WtxMzpqWy6COHpkshESmkbP/beZ0QM/3tXat6FtJmImzOSdkiIhh7Qa4V6l9t0pUtyAPD2oQgQg0j5+foli2AkRMaBG3d3bwxVxhr5xQxjQ6E/+Q69/eWcIpZ0WK64pPi9eNcrAoyZ3TxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5738d4e2-fa01-4945-8671-10cca81bb4bd", "record_id": "flaws_cloudtrail:0000482:5738d4e2-fa01-4945-8671-10cca81bb4bd", "row_index": 482, "timestamp": "2017-02-28T01:24:10Z", "event_type": "ConsoleLogin", "event_source": "signin.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 779, "raw_record_depth": 2, "raw_record_top_level_keys": ["additionalEventData", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5738d4e2-fa01-4945-8671-10cca81bb4bd", "eventTime": "2017-02-28T01:24:10Z", "eventName": "ConsoleLogin", "eventSource": "signin.amazonaws.com", "eventType": "AwsConsoleSignIn", "sourceIPAddress": "255.253.125.115", "userAgent": "Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553"}, "responseElements": {"ConsoleLogin": "Success"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "27e08b2d-717c-4272-ae4c-b42dfb9cca2b", "record_id": "flaws_cloudtrail:0000483:27e08b2d-717c-4272-ae4c-b42dfb9cca2b", "row_index": 483, "timestamp": "2017-02-28T01:24:10Z", "event_type": "GetSessionToken", "event_source": "sts.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "signin.amazonaws.com", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 964, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "27e08b2d-717c-4272-ae4c-b42dfb9cca2b", "eventTime": "2017-02-28T01:24:10Z", "eventName": "GetSessionToken", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "signin.amazonaws.com", "awsRegion": "us-east-1", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "invokedBy": "signin.amazonaws.com"}, "requestParameters": {"durationSeconds": 43200}, "responseElements": {"credentials": {"accessKeyId": "ASIADGIYUF8OA0QFM5AS", "expiration": "Feb 28, 2017 1:24:10 PM", "sessionToken": "FQoDYXdzEFMaDJ3QrmqXuZ6E9kYg3iKZAUJ66LxPEA1i684nu5lAyCYUSTP8ZVJkw1zI1lmlJK05Q8M2Z4HYuW6K6oMNheZNrqrwzWpwgbhvkEX2aiiFKTk4BW01gbsWYTYbbdPJGIEau9XkKLzeh+t8jrQd2qAIihgoK6ADDqiRMdAZudE6Ragt5xAbw4qKvVagm9VG6J/eJNSrmZ5KXWe5qgpXRHSJhWoHk/EJy3yVPyi6otPFBQ=="}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4b01e9d7-3601-4e79-ad87-4c407df396a9", "record_id": "flaws_cloudtrail:0000484:4b01e9d7-3601-4e79-ad87-4c407df396a9", "row_index": 484, "timestamp": "2017-02-28T01:24:22Z", "event_type": "DescribeAvailabilityZones", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIASV95Y7RZHL0IXSZ5", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "85.50.251.255", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4b01e9d7-3601-4e79-ad87-4c407df396a9", "eventTime": "2017-02-28T01:24:22Z", "eventName": "DescribeAvailabilityZones", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "85.50.251.255", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIASV95Y7RZHL0IXSZ5", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"availabilityZoneSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "89c0b072-7308-45c2-809c-580c89683f52", "record_id": "flaws_cloudtrail:0000485:89c0b072-7308-45c2-809c-580c89683f52", "row_index": 485, "timestamp": "2017-02-28T01:24:22Z", "event_type": "DescribeVolumeStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIASV95Y7RZHL0IXSZ5", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "85.50.251.255", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 805, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "89c0b072-7308-45c2-809c-580c89683f52", "eventTime": "2017-02-28T01:24:22Z", "eventName": "DescribeVolumeStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "85.50.251.255", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIASV95Y7RZHL0IXSZ5", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "666010fa-8f7e-4b57-8a72-64324af6ee5", "record_id": "flaws_cloudtrail:0000486:666010fa-8f7e-4b57-8a72-64324af6ee5", "row_index": 486, "timestamp": "2017-02-28T01:24:22Z", "event_type": "DescribeInstanceStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIASV95Y7RZHL0IXSZ5", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "85.50.251.255", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 755, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "666010fa-8f7e-4b57-8a72-64324af6ee5", "eventTime": "2017-02-28T01:24:22Z", "eventName": "DescribeInstanceStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "85.50.251.255", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIASV95Y7RZHL0IXSZ5", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}, "includeAllInstances": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d23897-10cf-486f-9906-32dca669557", "record_id": "flaws_cloudtrail:0000487:d23897-10cf-486f-9906-32dca669557", "row_index": 487, "timestamp": "2017-02-28T01:24:22Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIASV95Y7RZHL0IXSZ5", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "85.50.251.255", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 716, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d23897-10cf-486f-9906-32dca669557", "eventTime": "2017-02-28T01:24:22Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "85.50.251.255", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIASV95Y7RZHL0IXSZ5", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"maxResults": 10000, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "514a7a4f-608f-4101-b58c-7b9266fc47a7", "record_id": "flaws_cloudtrail:0000488:514a7a4f-608f-4101-b58c-7b9266fc47a7", "row_index": 488, "timestamp": "2017-02-28T01:24:22Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIASV95Y7RZHL0IXSZ5", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "85.50.251.255", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 740, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "514a7a4f-608f-4101-b58c-7b9266fc47a7", "eventTime": "2017-02-28T01:24:22Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "85.50.251.255", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIASV95Y7RZHL0IXSZ5", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "66f406de-1a26-4c2c-b869-9ffd9c486a6c", "record_id": "flaws_cloudtrail:0000489:66f406de-1a26-4c2c-b869-9ffd9c486a6c", "row_index": 489, "timestamp": "2017-02-28T01:24:22Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIASV95Y7RZHL0IXSZ5", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "85.50.251.255", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 741, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "66f406de-1a26-4c2c-b869-9ffd9c486a6c", "eventTime": "2017-02-28T01:24:22Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "85.50.251.255", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIASV95Y7RZHL0IXSZ5", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"maxResults": 1000, "instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "54f323683-fe27-4b6c-8e6b-01c9e0180800", "record_id": "flaws_cloudtrail:0000490:54f323683-fe27-4b6c-8e6b-01c9e0180800", "row_index": 490, "timestamp": "2017-02-28T01:24:22Z", "event_type": "DescribeVolumeStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIASV95Y7RZHL0IXSZ5", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "85.50.251.255", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "54f323683-fe27-4b6c-8e6b-01c9e0180800", "eventTime": "2017-02-28T01:24:22Z", "eventName": "DescribeVolumeStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "85.50.251.255", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIASV95Y7RZHL0IXSZ5", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "517c72d2-e6c5-468d-afcc-2f0082bd6d15", "record_id": "flaws_cloudtrail:0000491:517c72d2-e6c5-468d-afcc-2f0082bd6d15", "row_index": 491, "timestamp": "2017-02-28T01:24:22Z", "event_type": "DescribeVolumeStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIASV95Y7RZHL0IXSZ5", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "85.50.251.255", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 807, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "517c72d2-e6c5-468d-afcc-2f0082bd6d15", "eventTime": "2017-02-28T01:24:22Z", "eventName": "DescribeVolumeStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "85.50.251.255", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIASV95Y7RZHL0IXSZ5", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "67c331a4-4bb8-4f6a-a7eb-f58e9f3ba133", "record_id": "flaws_cloudtrail:0000492:67c331a4-4bb8-4f6a-a7eb-f58e9f3ba133", "row_index": 492, "timestamp": "2017-02-28T01:24:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIASV95Y7RZHL0IXSZ5", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "85.50.251.255", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "67c331a4-4bb8-4f6a-a7eb-f58e9f3ba133", "eventTime": "2017-02-28T01:24:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "85.50.251.255", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIASV95Y7RZHL0IXSZ5", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {"items": [{"user": "self"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "76637-e917-4c9b-bdde-ccefd8020121", "record_id": "flaws_cloudtrail:0000493:76637-e917-4c9b-bdde-ccefd8020121", "row_index": 493, "timestamp": "2017-02-28T01:24:23Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIASV95Y7RZHL0IXSZ5", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "85.50.251.255", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 800, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "76637-e917-4c9b-bdde-ccefd8020121", "eventTime": "2017-02-28T01:24:23Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "85.50.251.255", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIASV95Y7RZHL0IXSZ5", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "152a83ba-8154-4b37-b89a-49498187682a", "record_id": "flaws_cloudtrail:0000494:152a83ba-8154-4b37-b89a-49498187682a", "row_index": 494, "timestamp": "2017-02-28T01:24:23Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIASV95Y7RZHL0IXSZ5", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "85.50.251.255", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 800, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "152a83ba-8154-4b37-b89a-49498187682a", "eventTime": "2017-02-28T01:24:23Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "85.50.251.255", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIASV95Y7RZHL0IXSZ5", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a922a047-61ac-4f72-8e0e-dae94e5a4566", "record_id": "flaws_cloudtrail:0000495:a922a047-61ac-4f72-8e0e-dae94e5a4566", "row_index": 495, "timestamp": "2017-02-28T01:24:23Z", "event_type": "DescribeAvailabilityZones", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIASV95Y7RZHL0IXSZ5", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "85.50.251.255", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 723, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a922a047-61ac-4f72-8e0e-dae94e5a4566", "eventTime": "2017-02-28T01:24:23Z", "eventName": "DescribeAvailabilityZones", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "85.50.251.255", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIASV95Y7RZHL0IXSZ5", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"availabilityZoneSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bb726486a-0d5b-4ecd-8758-314eb767981de", "record_id": "flaws_cloudtrail:0000496:bb726486a-0d5b-4ecd-8758-314eb767981de", "row_index": 496, "timestamp": "2017-02-28T01:24:23Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIASV95Y7RZHL0IXSZ5", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "85.50.251.255", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bb726486a-0d5b-4ecd-8758-314eb767981de", "eventTime": "2017-02-28T01:24:23Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "85.50.251.255", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIASV95Y7RZHL0IXSZ5", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9a41b025-7215-4ecc-8aef-4ba0bb49c444", "record_id": "flaws_cloudtrail:0000497:9a41b025-7215-4ecc-8aef-4ba0bb49c444", "row_index": 497, "timestamp": "2017-02-28T01:24:25Z", "event_type": "DescribeVolumeStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 725, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9a41b025-7215-4ecc-8aef-4ba0bb49c444", "eventTime": "2017-02-28T01:24:25Z", "eventName": "DescribeVolumeStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4bf48f6c-2cec-4724-841c-6deaa99d008f", "record_id": "flaws_cloudtrail:0000498:4bf48f6c-2cec-4724-841c-6deaa99d008f", "row_index": 498, "timestamp": "2017-02-28T01:24:25Z", "event_type": "DescribeAccountAttributes", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 793, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4bf48f6c-2cec-4724-841c-6deaa99d008f", "eventTime": "2017-02-28T01:24:25Z", "eventName": "DescribeAccountAttributes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"accountAttributeNameSet": {"items": [{"attributeName": "supported-platforms"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "081f8a8b-ef2e-452d-92ee-b717658133c9", "record_id": "flaws_cloudtrail:0000499:081f8a8b-ef2e-452d-92ee-b717658133c9", "row_index": 499, "timestamp": "2017-02-28T01:24:25Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 720, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "081f8a8b-ef2e-452d-92ee-b717658133c9", "eventTime": "2017-02-28T01:24:25Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "80f261b0-b3fe-482c-a31c-1296399d8997", "record_id": "flaws_cloudtrail:0000500:80f261b0-b3fe-482c-a31c-1296399d8997", "row_index": 500, "timestamp": "2017-02-28T01:24:25Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 754, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "80f261b0-b3fe-482c-a31c-1296399d8997", "eventTime": "2017-02-28T01:24:25Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"pageSize": 300}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "103ce72e-f117-4b2c-b444-b91383fa1a1", "record_id": "flaws_cloudtrail:0000501:103ce72e-f117-4b2c-b444-b91383fa1a1", "row_index": 501, "timestamp": "2017-02-28T01:24:25Z", "event_type": "DescribeInstanceStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 755, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "103ce72e-f117-4b2c-b444-b91383fa1a1", "eventTime": "2017-02-28T01:24:25Z", "eventName": "DescribeInstanceStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}, "includeAllInstances": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f8c39ba6-2ec5-4cab-ab11-06373dd8fd1", "record_id": "flaws_cloudtrail:0000502:f8c39ba6-2ec5-4cab-ab11-06373dd8fd1", "row_index": 502, "timestamp": "2017-02-28T01:24:25Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 757, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f8c39ba6-2ec5-4cab-ab11-06373dd8fd1", "eventTime": "2017-02-28T01:24:25Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "42b20535-3b68-499f-931d-826ac2038ab2", "record_id": "flaws_cloudtrail:0000503:42b20535-3b68-499f-931d-826ac2038ab2", "row_index": 503, "timestamp": "2017-02-28T01:24:25Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 768, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "42b20535-3b68-499f-931d-826ac2038ab2", "eventTime": "2017-02-28T01:24:25Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"pageSize": 300}, "responseElements": {"loadBalancers": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f74cba82-0d76-4af2-8e62-3c583254eb3eb", "record_id": "flaws_cloudtrail:0000504:f74cba82-0d76-4af2-8e62-3c583254eb3eb", "row_index": 504, "timestamp": "2017-02-28T01:24:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 784, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f74cba82-0d76-4af2-8e62-3c583254eb3eb", "eventTime": "2017-02-28T01:24:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"snapshotSet": {}, "ownersSet": {"items": [{"owner": "self"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "17b43ab7-aec5-4b8c-8901-239a0ab46b82", "record_id": "flaws_cloudtrail:0000505:17b43ab7-aec5-4b8c-8901-239a0ab46b82", "row_index": 505, "timestamp": "2017-02-28T01:24:25Z", "event_type": "DescribeAvailabilityZones", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 725, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "17b43ab7-aec5-4b8c-8901-239a0ab46b82", "eventTime": "2017-02-28T01:24:25Z", "eventName": "DescribeAvailabilityZones", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"availabilityZoneSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "750e8cb0-b48b-470e-bb27-5be040a742894", "record_id": "flaws_cloudtrail:0000506:750e8cb0-b48b-470e-bb27-5be040a742894", "row_index": 506, "timestamp": "2017-02-28T01:24:25Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 744, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "750e8cb0-b48b-470e-bb27-5be040a742894", "eventTime": "2017-02-28T01:24:25Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"maxResults": 1000, "instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8219db41-60bd-441d-9624-485c7dd452ad", "record_id": "flaws_cloudtrail:0000507:8219db41-60bd-441d-9624-485c7dd452ad", "row_index": 507, "timestamp": "2017-02-28T01:24:25Z", "event_type": "DescribeAccountAttributes", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 785, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8219db41-60bd-441d-9624-485c7dd452ad", "eventTime": "2017-02-28T01:24:25Z", "eventName": "DescribeAccountAttributes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"accountAttributeNameSet": {"items": [{"attributeName": "default-vpc"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d1bd2d41-0791-4bf8-887a-e485cde2c8da", "record_id": "flaws_cloudtrail:0000508:d1bd2d41-0791-4bf8-887a-e485cde2c8da", "row_index": 508, "timestamp": "2017-02-28T01:24:25Z", "event_type": "DescribeKeyPairs", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 718, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d1bd2d41-0791-4bf8-887a-e485cde2c8da", "eventTime": "2017-02-28T01:24:25Z", "eventName": "DescribeKeyPairs", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"keySet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "af9c8ff5-e164-4fed-939a-9e610e7aca37", "record_id": "flaws_cloudtrail:0000509:af9c8ff5-e164-4fed-939a-9e610e7aca37", "row_index": 509, "timestamp": "2017-02-28T01:24:25Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 745, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "af9c8ff5-e164-4fed-939a-9e610e7aca37", "eventTime": "2017-02-28T01:24:25Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6e6674ac-c41d-4cb6-8c16-8a30897bf", "record_id": "flaws_cloudtrail:0000510:6e6674ac-c41d-4cb6-8c16-8a30897bf", "row_index": 510, "timestamp": "2017-02-28T01:24:25Z", "event_type": "DescribeHosts", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 788, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6e6674ac-c41d-4cb6-8c16-8a30897bf", "eventTime": "2017-02-28T01:24:25Z", "eventName": "DescribeHosts", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"DescribeHostsRequest": {"Filter": {"Value": {"tag": "1", "content": "available"}, "tag": "1", "Name": "state"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "877a6fbe-9831-408b-a97c-428839b060c4", "record_id": "flaws_cloudtrail:0000511:877a6fbe-9831-408b-a97c-428839b060c4", "row_index": 511, "timestamp": "2017-02-28T01:24:25Z", "event_type": "DescribePlacementGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 736, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "877a6fbe-9831-408b-a97c-428839b060c4", "eventTime": "2017-02-28T01:24:25Z", "eventName": "DescribePlacementGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"placementGroupSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a6fd0926-225c-4fa3-9992-669d9849b157", "record_id": "flaws_cloudtrail:0000512:a6fd0926-225c-4fa3-9992-669d9849b157", "row_index": 512, "timestamp": "2017-02-28T01:24:28Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a6fd0926-225c-4fa3-9992-669d9849b157", "eventTime": "2017-02-28T01:24:28Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "894785f49-d23c-4a52-a59f-7c79efc86300", "record_id": "flaws_cloudtrail:0000513:894785f49-d23c-4a52-a59f-7c79efc86300", "row_index": 513, "timestamp": "2017-02-28T01:24:28Z", "event_type": "DescribeVolumeStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 810, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "894785f49-d23c-4a52-a59f-7c79efc86300", "eventTime": "2017-02-28T01:24:28Z", "eventName": "DescribeVolumeStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "98fc23a7-aaf8-440f-b84f-3d5ec40b4664", "record_id": "flaws_cloudtrail:0000514:98fc23a7-aaf8-440f-b84f-3d5ec40b4664", "row_index": 514, "timestamp": "2017-02-28T01:24:28Z", "event_type": "DescribeVolumeStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "98fc23a7-aaf8-440f-b84f-3d5ec40b4664", "eventTime": "2017-02-28T01:24:28Z", "eventName": "DescribeVolumeStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "06f9b8c7-c583-4675-a9f4-4dd6514e6e74", "record_id": "flaws_cloudtrail:0000515:06f9b8c7-c583-4675-a9f4-4dd6514e6e74", "row_index": 515, "timestamp": "2017-02-28T01:24:28Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "06f9b8c7-c583-4675-a9f4-4dd6514e6e74", "eventTime": "2017-02-28T01:24:28Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1f9a827b-4b56-443d-9488-d705ef6bfa15", "record_id": "flaws_cloudtrail:0000516:1f9a827b-4b56-443d-9488-d705ef6bfa15", "row_index": 516, "timestamp": "2017-02-28T01:24:28Z", "event_type": "DescribeIdFormat", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1f9a827b-4b56-443d-9488-d705ef6bfa15", "eventTime": "2017-02-28T01:24:28Z", "eventName": "DescribeIdFormat", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ec2698a-4df2-4f3c-94fd-19822a455d11", "record_id": "flaws_cloudtrail:0000517:7ec2698a-4df2-4f3c-94fd-19822a455d11", "row_index": 517, "timestamp": "2017-02-28T01:24:28Z", "event_type": "DescribeVolumesModifications", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 762, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ec2698a-4df2-4f3c-94fd-19822a455d11", "eventTime": "2017-02-28T01:24:28Z", "eventName": "DescribeVolumesModifications", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"DescribeVolumesModificationsRequest": {"MaxResults": "1000"}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bfc63e79-3ddc-455b-bbea-ef7f1ab2cf8e", "record_id": "flaws_cloudtrail:0000518:bfc63e79-3ddc-455b-bbea-ef7f1ab2cf8e", "row_index": 518, "timestamp": "2017-02-28T01:24:28Z", "event_type": "DescribeVolumeStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bfc63e79-3ddc-455b-bbea-ef7f1ab2cf8e", "eventTime": "2017-02-28T01:24:28Z", "eventName": "DescribeVolumeStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3d5d3a83-d66b-4daf-a24e-7203efcf0b77", "record_id": "flaws_cloudtrail:0000519:3d5d3a83-d66b-4daf-a24e-7203efcf0b77", "row_index": 519, "timestamp": "2017-02-28T01:24:28Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3d5d3a83-d66b-4daf-a24e-7203efcf0b77", "eventTime": "2017-02-28T01:24:28Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "15abe02b-48b9-4862-a1af-b38a6cda656f", "record_id": "flaws_cloudtrail:0000520:15abe02b-48b9-4862-a1af-b38a6cda656f", "row_index": 520, "timestamp": "2017-02-28T01:24:29Z", "event_type": "ListAliases", "event_source": "kms.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Coral/Jakarta", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 718, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "15abe02b-48b9-4862-a1af-b38a6cda656f", "eventTime": "2017-02-28T01:24:29Z", "eventName": "ListAliases", "eventSource": "kms.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Coral/Jakarta", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"limit": 1000}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "efedac1f-3d7f-4da2-8054-5c7ba98bcc9b", "record_id": "flaws_cloudtrail:0000521:efedac1f-3d7f-4da2-8054-5c7ba98bcc9b", "row_index": 521, "timestamp": "2017-02-28T01:24:29Z", "event_type": "DescribeAlarms", "event_source": "monitoring.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 709, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "efedac1f-3d7f-4da2-8054-5c7ba98bcc9b", "eventTime": "2017-02-28T01:24:29Z", "eventName": "DescribeAlarms", "eventSource": "monitoring.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"maxRecords": 100}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "718f67f3-71d8-486a-bd94-1c2a9147c33f", "record_id": "flaws_cloudtrail:0000522:718f67f3-71d8-486a-bd94-1c2a9147c33f", "row_index": 522, "timestamp": "2017-02-28T01:24:29Z", "event_type": "DescribeVolumeStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1022, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "718f67f3-71d8-486a-bd94-1c2a9147c33f", "eventTime": "2017-02-28T01:24:29Z", "eventName": "DescribeVolumeStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {"items": [{"volumeId": "vol-8e100f305b7a6fef3"}]}, "filterSet": {"items": [{"name": "volume-status.status", "valueSet": {"items": {"__truncated_type": "list"}}}, {"name": "volume-status.details-name", "valueSet": {"items": {"__truncated_type": "list"}}}, {"name": "volume-status.details-status", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "12a0a269-a595-4225-a264-d51c6d15344b", "record_id": "flaws_cloudtrail:0000523:12a0a269-a595-4225-a264-d51c6d15344b", "row_index": 523, "timestamp": "2017-02-28T01:24:29Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 849, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "12a0a269-a595-4225-a264-d51c6d15344b", "eventTime": "2017-02-28T01:24:29Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {"items": [{"volumeId": "vol-8e100f305b7a6fef3"}]}, "filterSet": {"items": [{"name": "attachment.status", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5afe0649-5ac9-428c-947b-4025ad1f97ef", "record_id": "flaws_cloudtrail:0000524:5afe0649-5ac9-428c-947b-4025ad1f97ef", "row_index": 524, "timestamp": "2017-02-28T01:24:29Z", "event_type": "DescribeVolumeAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 733, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5afe0649-5ac9-428c-947b-4025ad1f97ef", "eventTime": "2017-02-28T01:24:29Z", "eventName": "DescribeVolumeAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeId": "vol-8e100f305b7a6fef3"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be4bba85-f4e4-4531-b3b4-034a6b50ce49", "record_id": "flaws_cloudtrail:0000525:be4bba85-f4e4-4531-b3b4-034a6b50ce49", "row_index": 525, "timestamp": "2017-02-28T01:24:29Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be4bba85-f4e4-4531-b3b4-034a6b50ce49", "eventTime": "2017-02-28T01:24:29Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"maxResults": 10000, "filterSet": {"items": [{"name": "resource-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0686a13f-a85d-457a-92a9-49b922b1fa05", "record_id": "flaws_cloudtrail:0000526:0686a13f-a85d-457a-92a9-49b922b1fa05", "row_index": 526, "timestamp": "2017-02-28T01:24:29Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 849, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0686a13f-a85d-457a-92a9-49b922b1fa05", "eventTime": "2017-02-28T01:24:29Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {"items": [{"volumeId": "vol-8e100f305b7a6fef3"}]}, "filterSet": {"items": [{"name": "attachment.status", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "faf5a352-f3d8-4018-9c9f-865727d523a3", "record_id": "flaws_cloudtrail:0000527:faf5a352-f3d8-4018-9c9f-865727d523a3", "row_index": 527, "timestamp": "2017-02-28T01:24:29Z", "event_type": "DescribeVolumeStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1022, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "faf5a352-f3d8-4018-9c9f-865727d523a3", "eventTime": "2017-02-28T01:24:29Z", "eventName": "DescribeVolumeStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {"items": [{"volumeId": "vol-8e100f305b7a6fef3"}]}, "filterSet": {"items": [{"name": "volume-status.status", "valueSet": {"items": {"__truncated_type": "list"}}}, {"name": "volume-status.details-name", "valueSet": {"items": {"__truncated_type": "list"}}}, {"name": "volume-status.details-status", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5f211c47-8ab5-44d4-b23e-6de69f7ccf3b", "record_id": "flaws_cloudtrail:0000528:5f211c47-8ab5-44d4-b23e-6de69f7ccf3b", "row_index": 528, "timestamp": "2017-02-28T01:24:29Z", "event_type": "DescribeVolumeAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 733, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5f211c47-8ab5-44d4-b23e-6de69f7ccf3b", "eventTime": "2017-02-28T01:24:29Z", "eventName": "DescribeVolumeAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeId": "vol-8e100f305b7a6fef3"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "542e3966-10ce-41f0-a282-b1b3e0fddad4", "record_id": "flaws_cloudtrail:0000529:542e3966-10ce-41f0-a282-b1b3e0fddad4", "row_index": 529, "timestamp": "2017-02-28T01:24:29Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 849, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "542e3966-10ce-41f0-a282-b1b3e0fddad4", "eventTime": "2017-02-28T01:24:29Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {"items": [{"volumeId": "vol-8e100f305b7a6fef3"}]}, "filterSet": {"items": [{"name": "attachment.status", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "18fe80ee-998a-42ad-98d3-cc717797b689", "record_id": "flaws_cloudtrail:0000530:18fe80ee-998a-42ad-98d3-cc717797b689", "row_index": 530, "timestamp": "2017-02-28T01:24:29Z", "event_type": "DescribeVolumeStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1022, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "18fe80ee-998a-42ad-98d3-cc717797b689", "eventTime": "2017-02-28T01:24:29Z", "eventName": "DescribeVolumeStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {"items": [{"volumeId": "vol-8e100f305b7a6fef3"}]}, "filterSet": {"items": [{"name": "volume-status.status", "valueSet": {"items": {"__truncated_type": "list"}}}, {"name": "volume-status.details-name", "valueSet": {"items": {"__truncated_type": "list"}}}, {"name": "volume-status.details-status", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ae760bc0-a88c-4f37-a3b8-932353fdd1c57", "record_id": "flaws_cloudtrail:0000531:ae760bc0-a88c-4f37-a3b8-932353fdd1c57", "row_index": 531, "timestamp": "2017-02-28T01:24:29Z", "event_type": "DescribeVolumeAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 734, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ae760bc0-a88c-4f37-a3b8-932353fdd1c57", "eventTime": "2017-02-28T01:24:29Z", "eventName": "DescribeVolumeAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeId": "vol-8e100f305b7a6fef3"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "81f14adf-d791-4f5d-b4a0-6e3060c04def", "record_id": "flaws_cloudtrail:0000532:81f14adf-d791-4f5d-b4a0-6e3060c04def", "row_index": 532, "timestamp": "2017-02-28T01:24:29Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 847, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "81f14adf-d791-4f5d-b4a0-6e3060c04def", "eventTime": "2017-02-28T01:24:29Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {"items": [{"volumeId": "vol-8e100f305b7a6fef3"}]}, "filterSet": {"items": [{"name": "attachment.status", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "932f6d63-c04c-41e4-b878-7a79a887003ed", "record_id": "flaws_cloudtrail:0000533:932f6d63-c04c-41e4-b878-7a79a887003ed", "row_index": 533, "timestamp": "2017-02-28T01:24:29Z", "event_type": "DescribeVolumeStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1023, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "932f6d63-c04c-41e4-b878-7a79a887003ed", "eventTime": "2017-02-28T01:24:29Z", "eventName": "DescribeVolumeStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {"items": [{"volumeId": "vol-8e100f305b7a6fef3"}]}, "filterSet": {"items": [{"name": "volume-status.status", "valueSet": {"items": {"__truncated_type": "list"}}}, {"name": "volume-status.details-name", "valueSet": {"items": {"__truncated_type": "list"}}}, {"name": "volume-status.details-status", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "43ae855a-316d-4379-bf9a-5bb394be76e6", "record_id": "flaws_cloudtrail:0000534:43ae855a-316d-4379-bf9a-5bb394be76e6", "row_index": 534, "timestamp": "2017-02-28T01:24:29Z", "event_type": "DescribeVolumeAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 733, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "43ae855a-316d-4379-bf9a-5bb394be76e6", "eventTime": "2017-02-28T01:24:29Z", "eventName": "DescribeVolumeAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeId": "vol-8e100f305b7a6fef3"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "092216-fec7-4861-9a87-cd31aef3fa50", "record_id": "flaws_cloudtrail:0000535:092216-fec7-4861-9a87-cd31aef3fa50", "row_index": 535, "timestamp": "2017-02-28T01:24:39Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "252.254.2.6", "user_agent": "[aws-cli/1.10.13 Python/2.7.10 Darwin/15.6.0 botocore/1.3.30]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 639, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "092216-fec7-4861-9a87-cd31aef3fa50", "eventTime": "2017-02-28T01:24:39Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "252.254.2.6", "userAgent": "[aws-cli/1.10.13 Python/2.7.10 Darwin/15.6.0 botocore/1.3.30]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0a9fc743-c18e-455b-b351-aae41adbf566", "record_id": "flaws_cloudtrail:0000536:0a9fc743-c18e-455b-b351-aae41adbf566", "row_index": 536, "timestamp": "2017-02-28T01:24:49Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 811, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0a9fc743-c18e-455b-b351-aae41adbf566", "eventTime": "2017-02-28T01:24:49Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"maxResults": 10000, "filterSet": {"items": [{"name": "resource-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f6d3dea5-4f4f-41d3-8e09-44836ec87", "record_id": "flaws_cloudtrail:0000537:f6d3dea5-4f4f-41d3-8e09-44836ec87", "row_index": 537, "timestamp": "2017-02-28T01:24:49Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 781, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f6d3dea5-4f4f-41d3-8e09-44836ec87", "eventTime": "2017-02-28T01:24:49Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {"items": [{"user": "self"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6486ea7f-64cb-4c3e-83c5-af8d4a961fc1", "record_id": "flaws_cloudtrail:0000538:6486ea7f-64cb-4c3e-83c5-af8d4a961fc1", "row_index": 538, "timestamp": "2017-02-28T01:24:49Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 770, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6486ea7f-64cb-4c3e-83c5-af8d4a961fc1", "eventTime": "2017-02-28T01:24:49Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"snapshotId": "snap-4fd281251b99202a3", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3f40ce40-48c5-4a45-8d3e-11cea1d16b62", "record_id": "flaws_cloudtrail:0000539:3f40ce40-48c5-4a45-8d3e-11cea1d16b62", "row_index": 539, "timestamp": "2017-02-28T01:24:49Z", "event_type": "DescribeIdFormat", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3f40ce40-48c5-4a45-8d3e-11cea1d16b62", "eventTime": "2017-02-28T01:24:49Z", "eventName": "DescribeIdFormat", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0e0c41a9-a690-4739-b26f-22b7e390b75a", "record_id": "flaws_cloudtrail:0000540:0e0c41a9-a690-4739-b26f-22b7e390b75a", "row_index": 540, "timestamp": "2017-02-28T01:24:49Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 781, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0e0c41a9-a690-4739-b26f-22b7e390b75a", "eventTime": "2017-02-28T01:24:49Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"snapshotId": "snap-4fd281251b99202a3", "attributeType": "CREATE_VOLUME_PERMISSION"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e3b553f5-4633-46e3-990e-cd69a184ff3b", "record_id": "flaws_cloudtrail:0000541:e3b553f5-4633-46e3-990e-cd69a184ff3b", "row_index": 541, "timestamp": "2017-02-28T01:24:56Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "252.254.2.6", "user_agent": "[aws-cli/1.11.21 Python/2.7.10 Darwin/15.6.0 botocore/1.4.78]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 641, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e3b553f5-4633-46e3-990e-cd69a184ff3b", "eventTime": "2017-02-28T01:24:56Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "252.254.2.6", "userAgent": "[aws-cli/1.11.21 Python/2.7.10 Darwin/15.6.0 botocore/1.4.78]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7f56c41a-644e-4f86-858a-827bd4c554c4", "record_id": "flaws_cloudtrail:0000542:7f56c41a-644e-4f86-858a-827bd4c554c4", "row_index": 542, "timestamp": "2017-02-28T01:25:07Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 781, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7f56c41a-644e-4f86-858a-827bd4c554c4", "eventTime": "2017-02-28T01:25:07Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"snapshotId": "snap-4fd281251b99202a3", "attributeType": "CREATE_VOLUME_PERMISSION"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "85cfea88-1154-4f50-b504-e18143ada8", "record_id": "flaws_cloudtrail:0000543:85cfea88-1154-4f50-b504-e18143ada8", "row_index": 543, "timestamp": "2017-02-28T01:25:27Z", "event_type": "DescribeInstanceStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "85cfea88-1154-4f50-b504-e18143ada8", "eventTime": "2017-02-28T01:25:27Z", "eventName": "DescribeInstanceStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}, "includeAllInstances": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61f75d1e-76c5-4f71-9c3d-49f4394139e4", "record_id": "flaws_cloudtrail:0000544:61f75d1e-76c5-4f71-9c3d-49f4394139e4", "row_index": 544, "timestamp": "2017-02-28T01:25:27Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 741, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61f75d1e-76c5-4f71-9c3d-49f4394139e4", "eventTime": "2017-02-28T01:25:27Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d7faadb2-2cd6-4212-bc2f-f09ef4a22dd8", "record_id": "flaws_cloudtrail:0000545:d7faadb2-2cd6-4212-bc2f-f09ef4a22dd8", "row_index": 545, "timestamp": "2017-02-28T01:25:27Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 743, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d7faadb2-2cd6-4212-bc2f-f09ef4a22dd8", "eventTime": "2017-02-28T01:25:27Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"maxResults": 1000, "instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9d10919d-6ab4-4c20-86d7-9547aa1ef22f", "record_id": "flaws_cloudtrail:0000546:9d10919d-6ab4-4c20-86d7-9547aa1ef22f", "row_index": 546, "timestamp": "2017-02-28T01:25:28Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 784, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9d10919d-6ab4-4c20-86d7-9547aa1ef22f", "eventTime": "2017-02-28T01:25:28Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {"items": [{"user": "self"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "53b76a15-ff04-4d4d-a1d0-6322e4a2f68a", "record_id": "flaws_cloudtrail:0000547:53b76a15-ff04-4d4d-a1d0-6322e4a2f68a", "row_index": 547, "timestamp": "2017-02-28T01:25:28Z", "event_type": "ModifySnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 903, "raw_record_depth": 6, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "53b76a15-ff04-4d4d-a1d0-6322e4a2f68a", "eventTime": "2017-02-28T01:25:28Z", "eventName": "ModifySnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"snapshotId": "snap-4fd281251b99202a3", "createVolumePermission": {"add": {"items": [{"group": "all"}]}}, "attributeType": "CREATE_VOLUME_PERMISSION"}, "responseElements": {"requestId": "fb69dcf6-9d72-465b-b3dc-d0d0688d8403", "_return": true}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "505ddd8c-1064-4f3d-8f03-f9a0495e1d7f", "record_id": "flaws_cloudtrail:0000548:505ddd8c-1064-4f3d-8f03-f9a0495e1d7f", "row_index": 548, "timestamp": "2017-02-28T01:25:29Z", "event_type": "DescribeVolumesModifications", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "505ddd8c-1064-4f3d-8f03-f9a0495e1d7f", "eventTime": "2017-02-28T01:25:29Z", "eventName": "DescribeVolumesModifications", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"DescribeVolumesModificationsRequest": {"MaxResults": "1000"}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "404731a-b346-464d-b378-94f4df48f14c", "record_id": "flaws_cloudtrail:0000549:404731a-b346-464d-b378-94f4df48f14c", "row_index": 549, "timestamp": "2017-02-28T01:25:29Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "404731a-b346-464d-b378-94f4df48f14c", "eventTime": "2017-02-28T01:25:29Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1cd20e78-5182-4ca9-b333-1d30b5c206711", "record_id": "flaws_cloudtrail:0000550:1cd20e78-5182-4ca9-b333-1d30b5c206711", "row_index": 550, "timestamp": "2017-02-28T01:25:29Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 805, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1cd20e78-5182-4ca9-b333-1d30b5c206711", "eventTime": "2017-02-28T01:25:29Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9fd740ae-d5fd-45ee-b184-8d087c86a07e", "record_id": "flaws_cloudtrail:0000551:9fd740ae-d5fd-45ee-b184-8d087c86a07e", "row_index": 551, "timestamp": "2017-02-28T01:25:29Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 803, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9fd740ae-d5fd-45ee-b184-8d087c86a07e", "eventTime": "2017-02-28T01:25:29Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "609577f35-1dad-4755-8dc5-6acf917cc4e9", "record_id": "flaws_cloudtrail:0000552:609577f35-1dad-4755-8dc5-6acf917cc4e9", "row_index": 552, "timestamp": "2017-02-28T01:25:29Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 722, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "609577f35-1dad-4755-8dc5-6acf917cc4e9", "eventTime": "2017-02-28T01:25:29Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"maxResults": 10000, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "45931b68-49dd-4f90-93b9-33b909f85f72", "record_id": "flaws_cloudtrail:0000553:45931b68-49dd-4f90-93b9-33b909f85f72", "row_index": 553, "timestamp": "2017-02-28T01:25:29Z", "event_type": "DescribeVolumeStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "45931b68-49dd-4f90-93b9-33b909f85f72", "eventTime": "2017-02-28T01:25:29Z", "eventName": "DescribeVolumeStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "54464-7c1c-4c5c-ad24-ddda8fca6de0", "record_id": "flaws_cloudtrail:0000554:54464-7c1c-4c5c-ad24-ddda8fca6de0", "row_index": 554, "timestamp": "2017-02-28T01:25:29Z", "event_type": "DescribeVolumeStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "54464-7c1c-4c5c-ad24-ddda8fca6de0", "eventTime": "2017-02-28T01:25:29Z", "eventName": "DescribeVolumeStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bb84415-fd61-4392-92dd-4b8e6ba0d76b", "record_id": "flaws_cloudtrail:0000555:bb84415-fd61-4392-92dd-4b8e6ba0d76b", "row_index": 555, "timestamp": "2017-02-28T01:25:29Z", "event_type": "DescribeVolumeStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 808, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bb84415-fd61-4392-92dd-4b8e6ba0d76b", "eventTime": "2017-02-28T01:25:29Z", "eventName": "DescribeVolumeStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "59c0543c-162e-477d-8901-1b216290ae2bc", "record_id": "flaws_cloudtrail:0000556:59c0543c-162e-477d-8901-1b216290ae2bc", "row_index": 556, "timestamp": "2017-02-28T01:25:30Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 759, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "59c0543c-162e-477d-8901-1b216290ae2bc", "eventTime": "2017-02-28T01:25:30Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cc9b8377-887f-447e-b70c-5a3c8d160eae", "record_id": "flaws_cloudtrail:0000557:cc9b8377-887f-447e-b70c-5a3c8d160eae", "row_index": 557, "timestamp": "2017-02-28T01:25:32Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 721, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cc9b8377-887f-447e-b70c-5a3c8d160eae", "eventTime": "2017-02-28T01:25:32Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"maxResults": 10000, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "47e7fc0c-10b8-4db9-b931-878f8b96bc3c", "record_id": "flaws_cloudtrail:0000558:47e7fc0c-10b8-4db9-b931-878f8b96bc3c", "row_index": 558, "timestamp": "2017-02-28T01:25:34Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 754, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "47e7fc0c-10b8-4db9-b931-878f8b96bc3c", "eventTime": "2017-02-28T01:25:34Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"pageSize": 300}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "162d665e-148a-45d2-b329-a3db8bb07fe3", "record_id": "flaws_cloudtrail:0000559:162d665e-148a-45d2-b329-a3db8bb07fe3", "row_index": 559, "timestamp": "2017-02-28T01:25:39Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 811, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "162d665e-148a-45d2-b329-a3db8bb07fe3", "eventTime": "2017-02-28T01:25:39Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"maxResults": 10000, "filterSet": {"items": [{"name": "resource-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3dce98b6-e614-4cd2-8208-a9acdf63289a", "record_id": "flaws_cloudtrail:0000560:3dce98b6-e614-4cd2-8208-a9acdf63289a", "row_index": 560, "timestamp": "2017-02-28T01:25:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 785, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3dce98b6-e614-4cd2-8208-a9acdf63289a", "eventTime": "2017-02-28T01:25:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {"items": [{"user": "self"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e2a3f577-e305-4339-a510-faf900708be43", "record_id": "flaws_cloudtrail:0000561:e2a3f577-e305-4339-a510-faf900708be43", "row_index": 561, "timestamp": "2017-02-28T01:25:39Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e2a3f577-e305-4339-a510-faf900708be43", "eventTime": "2017-02-28T01:25:39Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"snapshotId": "snap-4fd281251b99202a3", "attributeType": "CREATE_VOLUME_PERMISSION"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f819690-dafe-457d-a668-d447ab2bcac1", "record_id": "flaws_cloudtrail:0000562:f819690-dafe-457d-a668-d447ab2bcac1", "row_index": 562, "timestamp": "2017-02-28T01:26:11Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-cli/1.11.47 Python/2.7.3 Linux/3.2.0-4-amd64 botocore/1.5.10", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 775, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f819690-dafe-457d-a668-d447ab2bcac1", "eventTime": "2017-02-28T01:26:11Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-cli/1.11.47 Python/2.7.3 Linux/3.2.0-4-amd64 botocore/1.5.10", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "84bc0631-aa4f-4354-aad7-9b75d8eecfa5", "record_id": "flaws_cloudtrail:0000563:84bc0631-aa4f-4354-aad7-9b75d8eecfa5", "row_index": 563, "timestamp": "2017-02-28T01:26:43Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAS9K7DAKGZ3S6QQJC", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.143.251.253", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 742, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "84bc0631-aa4f-4354-aad7-9b75d8eecfa5", "eventTime": "2017-02-28T01:26:43Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.143.251.253", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAS9K7DAKGZ3S6QQJC", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9419d054-3aa9-4f3d-a001-c27447e88", "record_id": "flaws_cloudtrail:0000564:9419d054-3aa9-4f3d-a001-c27447e88", "row_index": 564, "timestamp": "2017-02-28T01:26:43Z", "event_type": "DescribeVolumeStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAS9K7DAKGZ3S6QQJC", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.143.251.253", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9419d054-3aa9-4f3d-a001-c27447e88", "eventTime": "2017-02-28T01:26:43Z", "eventName": "DescribeVolumeStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.143.251.253", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAS9K7DAKGZ3S6QQJC", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f2be8933-6f6d-4fad-bb24-ea46ab93d4fd", "record_id": "flaws_cloudtrail:0000565:f2be8933-6f6d-4fad-bb24-ea46ab93d4fd", "row_index": 565, "timestamp": "2017-02-28T01:26:43Z", "event_type": "DescribeVolumeStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAS9K7DAKGZ3S6QQJC", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.143.251.253", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f2be8933-6f6d-4fad-bb24-ea46ab93d4fd", "eventTime": "2017-02-28T01:26:43Z", "eventName": "DescribeVolumeStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.143.251.253", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAS9K7DAKGZ3S6QQJC", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b07d8c55-88bf-46c1-9c2d-6c69b0bf47a6", "record_id": "flaws_cloudtrail:0000566:b07d8c55-88bf-46c1-9c2d-6c69b0bf47a6", "row_index": 566, "timestamp": "2017-02-28T01:26:43Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAS9K7DAKGZ3S6QQJC", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.143.251.253", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 717, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b07d8c55-88bf-46c1-9c2d-6c69b0bf47a6", "eventTime": "2017-02-28T01:26:43Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.143.251.253", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAS9K7DAKGZ3S6QQJC", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"maxResults": 10000, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "182cdadf-0ea5-4f9b-9628-da3f19677e57", "record_id": "flaws_cloudtrail:0000567:182cdadf-0ea5-4f9b-9628-da3f19677e57", "row_index": 567, "timestamp": "2017-02-28T01:26:43Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAS9K7DAKGZ3S6QQJC", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.143.251.253", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "182cdadf-0ea5-4f9b-9628-da3f19677e57", "eventTime": "2017-02-28T01:26:43Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.143.251.253", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAS9K7DAKGZ3S6QQJC", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ea965099-5734-400a-870d-3cfd20175c8e", "record_id": "flaws_cloudtrail:0000568:7ea965099-5734-400a-870d-3cfd20175c8e", "row_index": 568, "timestamp": "2017-02-28T01:26:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAS9K7DAKGZ3S6QQJC", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.143.251.253", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 785, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ea965099-5734-400a-870d-3cfd20175c8e", "eventTime": "2017-02-28T01:26:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.143.251.253", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAS9K7DAKGZ3S6QQJC", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {"items": [{"user": "self"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6a095fb0-f638-4070-96fa-dde0c1096645", "record_id": "flaws_cloudtrail:0000569:6a095fb0-f638-4070-96fa-dde0c1096645", "row_index": 569, "timestamp": "2017-02-28T01:26:43Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAS9K7DAKGZ3S6QQJC", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.143.251.253", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 743, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6a095fb0-f638-4070-96fa-dde0c1096645", "eventTime": "2017-02-28T01:26:43Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.143.251.253", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAS9K7DAKGZ3S6QQJC", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"maxResults": 1000, "instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a8e9d87a-1408-4564-88cf-866549cb0ef2", "record_id": "flaws_cloudtrail:0000570:a8e9d87a-1408-4564-88cf-866549cb0ef2", "row_index": 570, "timestamp": "2017-02-28T01:26:43Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAS9K7DAKGZ3S6QQJC", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.143.251.253", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a8e9d87a-1408-4564-88cf-866549cb0ef2", "eventTime": "2017-02-28T01:26:43Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.143.251.253", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAS9K7DAKGZ3S6QQJC", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b151551b7-deeb-4342-b463-b2e5826a4974", "record_id": "flaws_cloudtrail:0000571:b151551b7-deeb-4342-b463-b2e5826a4974", "row_index": 571, "timestamp": "2017-02-28T01:26:43Z", "event_type": "DescribeInstanceStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAS9K7DAKGZ3S6QQJC", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.143.251.253", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 759, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b151551b7-deeb-4342-b463-b2e5826a4974", "eventTime": "2017-02-28T01:26:43Z", "eventName": "DescribeInstanceStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.143.251.253", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAS9K7DAKGZ3S6QQJC", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}, "includeAllInstances": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1d1f1595-6e2f-4e28-8e47-2f3d2d606906a", "record_id": "flaws_cloudtrail:0000572:1d1f1595-6e2f-4e28-8e47-2f3d2d606906a", "row_index": 572, "timestamp": "2017-02-28T01:26:43Z", "event_type": "DescribeVolumeStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAS9K7DAKGZ3S6QQJC", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.143.251.253", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 811, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1d1f1595-6e2f-4e28-8e47-2f3d2d606906a", "eventTime": "2017-02-28T01:26:43Z", "eventName": "DescribeVolumeStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.143.251.253", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAS9K7DAKGZ3S6QQJC", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cccd6616-2a02-4c4a-bdcb-e6b35bf31968", "record_id": "flaws_cloudtrail:0000573:cccd6616-2a02-4c4a-bdcb-e6b35bf31968", "row_index": 573, "timestamp": "2017-02-28T01:26:43Z", "event_type": "DescribeAvailabilityZones", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAS9K7DAKGZ3S6QQJC", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.143.251.253", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 725, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cccd6616-2a02-4c4a-bdcb-e6b35bf31968", "eventTime": "2017-02-28T01:26:43Z", "eventName": "DescribeAvailabilityZones", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.143.251.253", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAS9K7DAKGZ3S6QQJC", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"availabilityZoneSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "22d436d6-e022-4b61-ac3f-69c81d0b8a7e", "record_id": "flaws_cloudtrail:0000574:22d436d6-e022-4b61-ac3f-69c81d0b8a7e", "row_index": 574, "timestamp": "2017-02-28T01:26:43Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAS9K7DAKGZ3S6QQJC", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.143.251.253", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "22d436d6-e022-4b61-ac3f-69c81d0b8a7e", "eventTime": "2017-02-28T01:26:43Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.143.251.253", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAS9K7DAKGZ3S6QQJC", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3579a841-d528-4a8c-8b20-12642e10e3c8", "record_id": "flaws_cloudtrail:0000575:3579a841-d528-4a8c-8b20-12642e10e3c8", "row_index": 575, "timestamp": "2017-02-28T01:26:43Z", "event_type": "DescribeAvailabilityZones", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAS9K7DAKGZ3S6QQJC", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "227.143.251.253", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 725, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3579a841-d528-4a8c-8b20-12642e10e3c8", "eventTime": "2017-02-28T01:26:43Z", "eventName": "DescribeAvailabilityZones", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "227.143.251.253", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAS9K7DAKGZ3S6QQJC", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"availabilityZoneSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "59df6db0-5400-44fd-8ab5-e96e536b112d", "record_id": "flaws_cloudtrail:0000576:59df6db0-5400-44fd-8ab5-e96e536b112d", "row_index": 576, "timestamp": "2017-02-28T01:26:45Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 784, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "59df6db0-5400-44fd-8ab5-e96e536b112d", "eventTime": "2017-02-28T01:26:45Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {"items": [{"user": "self"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7eb4c8db-ab60-47a8-bd40-10c351e003b8", "record_id": "flaws_cloudtrail:0000577:7eb4c8db-ab60-47a8-bd40-10c351e003b8", "row_index": 577, "timestamp": "2017-02-28T01:26:45Z", "event_type": "DescribeIdFormat", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 694, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7eb4c8db-ab60-47a8-bd40-10c351e003b8", "eventTime": "2017-02-28T01:26:45Z", "eventName": "DescribeIdFormat", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cf6ee491-a546-4d7c-995f-8e80b5bb07a8", "record_id": "flaws_cloudtrail:0000578:cf6ee491-a546-4d7c-995f-8e80b5bb07a8", "row_index": 578, "timestamp": "2017-02-28T01:26:46Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 770, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cf6ee491-a546-4d7c-995f-8e80b5bb07a8", "eventTime": "2017-02-28T01:26:46Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"snapshotId": "snap-4fd281251b99202a3", "attributeType": "PRODUCT_CODES"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4a06e434-4f13-437f-89a1-6125e93c2ac1", "record_id": "flaws_cloudtrail:0000579:4a06e434-4f13-437f-89a1-6125e93c2ac1", "row_index": 579, "timestamp": "2017-02-28T01:26:46Z", "event_type": "ListAliases", "event_source": "kms.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "Coral/Jakarta", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 718, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4a06e434-4f13-437f-89a1-6125e93c2ac1", "eventTime": "2017-02-28T01:26:46Z", "eventName": "ListAliases", "eventSource": "kms.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "Coral/Jakarta", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"limit": 1000}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b6a820f0-989f-40ff-b641-6d2426c00094", "record_id": "flaws_cloudtrail:0000580:b6a820f0-989f-40ff-b641-6d2426c00094", "row_index": 580, "timestamp": "2017-02-28T01:26:46Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b6a820f0-989f-40ff-b641-6d2426c00094", "eventTime": "2017-02-28T01:26:46Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"snapshotId": "snap-4fd281251b99202a3", "attributeType": "CREATE_VOLUME_PERMISSION"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a2a9f53c-099c-4c46-ad8b-09bff45883a2", "record_id": "flaws_cloudtrail:0000581:a2a9f53c-099c-4c46-ad8b-09bff45883a2", "row_index": 581, "timestamp": "2017-02-28T01:26:46Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 811, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a2a9f53c-099c-4c46-ad8b-09bff45883a2", "eventTime": "2017-02-28T01:26:46Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"maxResults": 10000, "filterSet": {"items": [{"name": "resource-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c0457c48-3fc1-4c31-9b25-e3acb6efd8e6", "record_id": "flaws_cloudtrail:0000582:c0457c48-3fc1-4c31-9b25-e3acb6efd8e6", "row_index": 582, "timestamp": "2017-02-28T01:27:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "aws-cli/1.11.47 Python/2.7.3 Linux/3.2.0-4-amd64 botocore/1.5.10", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 791, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c0457c48-3fc1-4c31-9b25-e3acb6efd8e6", "eventTime": "2017-02-28T01:27:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "aws-cli/1.11.47 Python/2.7.3 Linux/3.2.0-4-amd64 botocore/1.5.10", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b9b56dcf-c5bd-43b2-9044-60f8b3c14dee", "record_id": "flaws_cloudtrail:0000583:b9b56dcf-c5bd-43b2-9044-60f8b3c14dee", "row_index": 583, "timestamp": "2017-02-28T01:27:46Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 743, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b9b56dcf-c5bd-43b2-9044-60f8b3c14dee", "eventTime": "2017-02-28T01:27:46Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"maxResults": 1000, "instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dc70c8f7-c80d-49dc-affa-91a977d7bfa2", "record_id": "flaws_cloudtrail:0000584:dc70c8f7-c80d-49dc-affa-91a977d7bfa2", "row_index": 584, "timestamp": "2017-02-28T01:27:46Z", "event_type": "DescribeAddresses", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dc70c8f7-c80d-49dc-affa-91a977d7bfa2", "eventTime": "2017-02-28T01:27:46Z", "eventName": "DescribeAddresses", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"publicIpsSet": {}, "filterSet": {}, "allocationIdsSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2947f0ab-ec3a-4cc5-adad-733f70908a5c", "record_id": "flaws_cloudtrail:0000585:2947f0ab-ec3a-4cc5-adad-733f70908a5c", "row_index": 585, "timestamp": "2017-02-28T01:27:46Z", "event_type": "DescribeInstanceStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 758, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2947f0ab-ec3a-4cc5-adad-733f70908a5c", "eventTime": "2017-02-28T01:27:46Z", "eventName": "DescribeInstanceStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"instancesSet": {}, "filterSet": {}, "includeAllInstances": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a4e5eadd-ee9e-4bb9-8683-957e2994a0c1", "record_id": "flaws_cloudtrail:0000586:a4e5eadd-ee9e-4bb9-8683-957e2994a0c1", "row_index": 586, "timestamp": "2017-02-28T01:27:48Z", "event_type": "DescribeSecurityGroups", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 758, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a4e5eadd-ee9e-4bb9-8683-957e2994a0c1", "eventTime": "2017-02-28T01:27:48Z", "eventName": "DescribeSecurityGroups", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"securityGroupSet": {}, "securityGroupIdSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "894b7f6b-f1f7-4040-a394-61c6cb8b6471", "record_id": "flaws_cloudtrail:0000587:894b7f6b-f1f7-4040-a394-61c6cb8b6471", "row_index": 587, "timestamp": "2017-02-28T01:27:51Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 784, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "894b7f6b-f1f7-4040-a394-61c6cb8b6471", "eventTime": "2017-02-28T01:27:51Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {"items": [{"user": "self"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4f05d172-13f2-452c-aab4-6a83cf64567", "record_id": "flaws_cloudtrail:0000588:4f05d172-13f2-452c-aab4-6a83cf64567", "row_index": 588, "timestamp": "2017-02-28T01:27:54Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 720, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4f05d172-13f2-452c-aab4-6a83cf64567", "eventTime": "2017-02-28T01:27:54Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"maxResults": 10000, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5333e333-6814-4417-b256-829768a18d9be", "record_id": "flaws_cloudtrail:0000589:5333e333-6814-4417-b256-829768a18d9be", "row_index": 589, "timestamp": "2017-02-28T01:27:57Z", "event_type": "DescribeVolumeStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5333e333-6814-4417-b256-829768a18d9be", "eventTime": "2017-02-28T01:27:57Z", "eventName": "DescribeVolumeStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f6e1e012-5224-4f4d-80b8-bf8fdd6ab9a9", "record_id": "flaws_cloudtrail:0000590:f6e1e012-5224-4f4d-80b8-bf8fdd6ab9a9", "row_index": 590, "timestamp": "2017-02-28T01:27:57Z", "event_type": "DescribeTags", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 721, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f6e1e012-5224-4f4d-80b8-bf8fdd6ab9a9", "eventTime": "2017-02-28T01:27:57Z", "eventName": "DescribeTags", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"maxResults": 10000, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e38de942-aa6d-4622-b337-bdccf4246fdb", "record_id": "flaws_cloudtrail:0000591:e38de942-aa6d-4622-b337-bdccf4246fdb", "row_index": 591, "timestamp": "2017-02-28T01:27:57Z", "event_type": "DescribeVolumeStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e38de942-aa6d-4622-b337-bdccf4246fdb", "eventTime": "2017-02-28T01:27:57Z", "eventName": "DescribeVolumeStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff117237f-ea11-4887-8e57-b58095d1edb", "record_id": "flaws_cloudtrail:0000592:ff117237f-ea11-4887-8e57-b58095d1edb", "row_index": 592, "timestamp": "2017-02-28T01:27:57Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 805, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff117237f-ea11-4887-8e57-b58095d1edb", "eventTime": "2017-02-28T01:27:57Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "08cf63c0-e467-4cea-a86a-1cd848c35af1", "record_id": "flaws_cloudtrail:0000593:08cf63c0-e467-4cea-a86a-1cd848c35af1", "row_index": 593, "timestamp": "2017-02-28T01:27:57Z", "event_type": "DescribeVolumeStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "08cf63c0-e467-4cea-a86a-1cd848c35af1", "eventTime": "2017-02-28T01:27:57Z", "eventName": "DescribeVolumeStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "54f708c8-d93d-498f-a342-107419ec219110", "record_id": "flaws_cloudtrail:0000594:54f708c8-d93d-498f-a342-107419ec219110", "row_index": 594, "timestamp": "2017-02-28T01:27:57Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 806, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "54f708c8-d93d-498f-a342-107419ec219110", "eventTime": "2017-02-28T01:27:57Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "04961dd-c7a6-4ad3-8319-a84c8f5a640b", "record_id": "flaws_cloudtrail:0000595:04961dd-c7a6-4ad3-8319-a84c8f5a640b", "row_index": 595, "timestamp": "2017-02-28T01:27:57Z", "event_type": "DescribeVolumesModifications", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 762, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "04961dd-c7a6-4ad3-8319-a84c8f5a640b", "eventTime": "2017-02-28T01:27:57Z", "eventName": "DescribeVolumesModifications", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"DescribeVolumesModificationsRequest": {"MaxResults": "1000"}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4a143406-a934-46ea-a9bc-1da38ed5edf1", "record_id": "flaws_cloudtrail:0000596:4a143406-a934-46ea-a9bc-1da38ed5edf1", "row_index": 596, "timestamp": "2017-02-28T01:27:57Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 804, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4a143406-a934-46ea-a9bc-1da38ed5edf1", "eventTime": "2017-02-28T01:27:57Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"volumeSet": {}, "filterSet": {"items": [{"name": "availability-zone", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ca3ca6a8-7356-486e-bb6c-47135bb787c9", "record_id": "flaws_cloudtrail:0000597:ca3ca6a8-7356-486e-bb6c-47135bb787c9", "row_index": 597, "timestamp": "2017-02-28T01:28:09Z", "event_type": "DescribeLoadBalancers", "event_source": "elasticloadbalancing.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAQF0T2BNMMXETAEG0", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 754, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ca3ca6a8-7356-486e-bb6c-47135bb787c9", "eventTime": "2017-02-28T01:28:09Z", "eventName": "DescribeLoadBalancers", "eventSource": "elasticloadbalancing.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAQF0T2BNMMXETAEG0", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"pageSize": 300}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5254c929-4dd7-4552-b7e0-82b891f7f810", "record_id": "flaws_cloudtrail:0000598:5254c929-4dd7-4552-b7e0-82b891f7f810", "row_index": 598, "timestamp": "2017-02-28T01:32:45Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1214, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5254c929-4dd7-4552-b7e0-82b891f7f810", "eventTime": "2017-02-28T01:32:45Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIAV5D7QP2HOQHML9A5", "expiration": "Feb 28, 2017 1:32:45 PM", "sessionToken": "FQoDYXdzEFMaDHJpq6IRspic1cL05yLfAXlh5+FNcVa9UN0Y86mkZDUMVKMCFStl70HXTiwH3SkpA/g/giI8yhd1Z2BG7fcuKTv3ZwUqQc7ly3IndAyCv8ugvytTop4EGn5xlU1lPHid4mqFrt2gMT1FsM16OuMgqe5w0jtib3i83Nai/hBoi/euIDVIhgtbaTRBaiSFX0iUOMFTj/APInTFxa/kod/+tEAKIhz3ucMefU1so3pKVF50bL63SmTQo5S/1ruSUvSDRkbXnqu7IYGBA/boHO99+/kFLII2ECocdAshPIg8Ju2rdSZrcY910fcNgHnhYAYovabTxQU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9741d517-212d-4a79-b77a-41450de08d27", "record_id": "flaws_cloudtrail:0000599:9741d517-212d-4a79-b77a-41450de08d27", "row_index": 599, "timestamp": "2017-02-28T01:32:45Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIAV5D7QP2HOQHML9A5", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "203.0.180.55", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1029, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9741d517-212d-4a79-b77a-41450de08d27", "eventTime": "2017-02-28T01:32:45Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "203.0.180.55", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIAV5D7QP2HOQHML9A5", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2017-02-28T01:32:45Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logGroupName": "/aws/lambda/Level6", "logStreamName": "2017/02/28/[$LATEST]26c6ed08c1054b1e4cd477abe38bae7c"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c0fe3cd8-6a53-4c8b-8129-c20a035fad8c", "record_id": "flaws_cloudtrail:0000600:c0fe3cd8-6a53-4c8b-8129-c20a035fad8c", "row_index": 600, "timestamp": "2017-02-28T01:33:26Z", "event_type": "GetAccountSummary", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "252.254.2.6", "user_agent": "Boto/2.43.0 Python/2.7.10 Darwin/15.6.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 786, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c0fe3cd8-6a53-4c8b-8129-c20a035fad8c", "eventTime": "2017-02-28T01:33:26Z", "eventName": "GetAccountSummary", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "252.254.2.6", "userAgent": "Boto/2.43.0 Python/2.7.10 Darwin/15.6.0", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:GetAccountSummary", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9fa4c379-9e84-428e-84cf-31cf8d02e2bc", "record_id": "flaws_cloudtrail:0000601:9fa4c379-9e84-428e-84cf-31cf8d02e2bc", "row_index": 601, "timestamp": "2017-02-28T01:33:27Z", "event_type": "ListUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "252.254.2.6", "user_agent": "Boto/2.43.0 Python/2.7.10 Darwin/15.6.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 809, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9fa4c379-9e84-428e-84cf-31cf8d02e2bc", "eventTime": "2017-02-28T01:33:27Z", "eventName": "ListUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "252.254.2.6", "userAgent": "Boto/2.43.0 Python/2.7.10 Darwin/15.6.0", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:ListUserPolicies on resource: user backup", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8ef5e63a-ae40-403b-9cab-adc1f19a3b1e", "record_id": "flaws_cloudtrail:0000602:8ef5e63a-ae40-403b-9cab-adc1f19a3b1e", "row_index": 602, "timestamp": "2017-02-28T01:33:27Z", "event_type": "GetAccountSummary", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "252.254.2.6", "user_agent": "Boto/2.43.0 Python/2.7.10 Darwin/15.6.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 786, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8ef5e63a-ae40-403b-9cab-adc1f19a3b1e", "eventTime": "2017-02-28T01:33:27Z", "eventName": "GetAccountSummary", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "252.254.2.6", "userAgent": "Boto/2.43.0 Python/2.7.10 Darwin/15.6.0", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: iam:GetAccountSummary", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a060d45a-498a-4779-9cb5-d728816b768080", "record_id": "flaws_cloudtrail:0000603:a060d45a-498a-4779-9cb5-d728816b768080", "row_index": 603, "timestamp": "2017-02-28T01:33:28Z", "event_type": "DescribeInstanceStatus", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "252.254.2.6", "user_agent": "Boto/2.43.0 Python/2.7.10 Darwin/15.6.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a060d45a-498a-4779-9cb5-d728816b768080", "eventTime": "2017-02-28T01:33:28Z", "eventName": "DescribeInstanceStatus", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "252.254.2.6", "userAgent": "Boto/2.43.0 Python/2.7.10 Darwin/15.6.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}, "includeAllInstances": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5be87499-39d7-459d-9ddc-c0ec2f09c34b", "record_id": "flaws_cloudtrail:0000604:5be87499-39d7-459d-9ddc-c0ec2f09c34b", "row_index": 604, "timestamp": "2017-02-28T01:33:28Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "252.254.2.6", "user_agent": "Boto/2.43.0 Python/2.7.10 Darwin/15.6.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 677, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5be87499-39d7-459d-9ddc-c0ec2f09c34b", "eventTime": "2017-02-28T01:33:28Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "252.254.2.6", "userAgent": "Boto/2.43.0 Python/2.7.10 Darwin/15.6.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0c3c805e-e84b-4cd3-8457-37c330423cbd2", "record_id": "flaws_cloudtrail:0000605:0c3c805e-e84b-4cd3-8457-37c330423cbd2", "row_index": 605, "timestamp": "2017-02-28T01:33:28Z", "event_type": "DescribeImages", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "252.254.2.6", "user_agent": "Boto/2.43.0 Python/2.7.10 Darwin/15.6.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 733, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0c3c805e-e84b-4cd3-8457-37c330423cbd2", "eventTime": "2017-02-28T01:33:28Z", "eventName": "DescribeImages", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "252.254.2.6", "userAgent": "Boto/2.43.0 Python/2.7.10 Darwin/15.6.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "requestParameters": {"executableBySet": {}, "imagesSet": {}, "ownersSet": {"items": [{"owner": "self"}]}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ef04b562-465c-41fb-92e0-e6ef86c90ff7", "record_id": "flaws_cloudtrail:0000606:ef04b562-465c-41fb-92e0-e6ef86c90ff7", "row_index": 606, "timestamp": "2017-02-28T01:33:29Z", "event_type": "DescribeDBSecurityGroups", "event_source": "rds.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "252.254.2.6", "user_agent": "Boto/2.43.0 Python/2.7.10 Darwin/15.6.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 801, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ef04b562-465c-41fb-92e0-e6ef86c90ff7", "eventTime": "2017-02-28T01:33:29Z", "eventName": "DescribeDBSecurityGroups", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "252.254.2.6", "userAgent": "Boto/2.43.0 Python/2.7.10 Darwin/15.6.0", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: rds:DescribeDBSecurityGroups", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1c4daa55-6582-4d40-88db-40ffd3ee54cb", "record_id": "flaws_cloudtrail:0000607:1c4daa55-6582-4d40-88db-40ffd3ee54cb", "row_index": 607, "timestamp": "2017-02-28T01:33:29Z", "event_type": "DescribeDBSnapshots", "event_source": "rds.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "252.254.2.6", "user_agent": "Boto/2.43.0 Python/2.7.10 Darwin/15.6.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 791, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1c4daa55-6582-4d40-88db-40ffd3ee54cb", "eventTime": "2017-02-28T01:33:29Z", "eventName": "DescribeDBSnapshots", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "252.254.2.6", "userAgent": "Boto/2.43.0 Python/2.7.10 Darwin/15.6.0", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: rds:DescribeDBSnapshots", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e547f8d5-7db1-4238-9970-cc44ba863ae2", "record_id": "flaws_cloudtrail:0000608:e547f8d5-7db1-4238-9970-cc44ba863ae2", "row_index": 608, "timestamp": "2017-02-28T01:33:29Z", "event_type": "DescribeDBInstances", "event_source": "rds.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA1ZBTOEKWKVHP6GHZ", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "252.254.2.6", "user_agent": "Boto/2.43.0 Python/2.7.10 Darwin/15.6.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 791, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e547f8d5-7db1-4238-9970-cc44ba863ae2", "eventTime": "2017-02-28T01:33:29Z", "eventName": "DescribeDBInstances", "eventSource": "rds.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "252.254.2.6", "userAgent": "Boto/2.43.0 Python/2.7.10 Darwin/15.6.0", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: rds:DescribeDBInstances", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA1ZBTOEKWKVHP6GHZ", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "df7cd1d8-cbeb-4e3d-97b7-3c216b2c800b", "record_id": "flaws_cloudtrail:0000609:df7cd1d8-cbeb-4e3d-97b7-3c216b2c800b", "row_index": 609, "timestamp": "2017-02-28T01:33:32Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "AWS Internal", "user_agent": "[AWSCloudTrail, aws-internal/3]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 634, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "df7cd1d8-cbeb-4e3d-97b7-3c216b2c800b", "eventTime": "2017-02-28T01:33:32Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "AWS Internal", "userAgent": "[AWSCloudTrail, aws-internal/3]", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f6a6b381-00b5-479a-9e20-97871c7e3e38", "record_id": "flaws_cloudtrail:0000610:f6a6b381-00b5-479a-9e20-97871c7e3e38", "row_index": 610, "timestamp": "2017-02-28T01:33:32Z", "event_type": "DescribeTrails", "event_source": "cloudtrail.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAUGSH9JLZF0O0O8XS", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "console.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 711, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f6a6b381-00b5-479a-9e20-97871c7e3e38", "eventTime": "2017-02-28T01:33:32Z", "eventName": "DescribeTrails", "eventSource": "cloudtrail.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "console.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAUGSH9JLZF0O0O8XS", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "requestParameters": {"trailNameList": []}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a81f2670-aaa1-49de-adf1-895108c", "record_id": "flaws_cloudtrail:0000611:a81f2670-aaa1-49de-adf1-895108c", "row_index": 611, "timestamp": "2017-02-28T01:33:33Z", "event_type": "DescribeConfigurationRecorderStatus", "event_source": "config.amazonaws.com", "principal": {"type": "Root", "arn": "arn:aws:iam::811596193553:root", "account_id": "811596193553", "principal_id": "811596193553", "user_name": null, "access_key_id": "ASIAUGSH9JLZF0O0O8XS", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.253.125.115", "user_agent": "AWSCloudTrail, aws-internal/3", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 715, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a81f2670-aaa1-49de-adf1-895108c", "eventTime": "2017-02-28T01:33:33Z", "eventName": "DescribeConfigurationRecorderStatus", "eventSource": "config.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.253.125.115", "userAgent": "AWSCloudTrail, aws-internal/3", "awsRegion": "us-west-2", "userIdentity": {"type": "Root", "principalId": "811596193553", "arn": "arn:aws:iam::811596193553:root", "accountId": "811596193553", "accessKeyId": "ASIAUGSH9JLZF0O0O8XS", "sessionContext": {"attributes": {"mfaAuthenticated": "true", "creationDate": "2017-02-28T01:24:10Z"}}}, "resources": []}}