Task: attack_reconstruction (flaws_cloudtrail)
Prompt: Review the CloudTrail records for a session-credentialed principal that moves from storage discovery into object access against an S3 bucket. Identify the responsible principal, the applicable MITRE ATT&CK technique, the supporting CloudTrail record_ids for each phase of the chain you reconstruct, and the impacted AWS assets. Return a JSON object matching the AttackReconstructionAnswer schema. Use principal.arn for primary_actor, the MITRE ATT&CK ID (e.g. T1530) for technique, and group the supporting CloudTrail record_ids by attack phase. List the AWS asset identifiers (bucket names, role/user names, trail names, ARNs) the attack acted on as impacted_assets.
Answer schema: attack_reconstruction_answer

CloudTrail records:
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61a3fa2c-e453-45da-bab4-7a1930b5ab32", "record_id": "flaws_cloudtrail:0000000:61a3fa2c-e453-45da-bab4-7a1930b5ab32", "row_index": 0, "timestamp": "2018-10-28T23:21:16Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "149.116.30.46", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 717, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61a3fa2c-e453-45da-bab4-7a1930b5ab32", "eventTime": "2018-10-28T23:21:16Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "149.116.30.46", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "266cfa93-1a7e-4bb0-b21b-12adf63288e7", "record_id": "flaws_cloudtrail:0000001:266cfa93-1a7e-4bb0-b21b-12adf63288e7", "row_index": 1, "timestamp": "2018-10-28T23:21:59Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "266cfa93-1a7e-4bb0-b21b-12adf63288e7", "eventTime": "2018-10-28T23:21:59Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "43e2a35a-c13c-471e-b0a2-a757ac05fbe0", "record_id": "flaws_cloudtrail:0000002:43e2a35a-c13c-471e-b0a2-a757ac05fbe0", "row_index": 2, "timestamp": "2018-10-28T23:22:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "43e2a35a-c13c-471e-b0a2-a757ac05fbe0", "eventTime": "2018-10-28T23:22:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJmdm9USHVCVTAwNGJrTnJnMTNnVmZ2Q0dOZ0x1WjdoY2I0RjJCYVZodEt1aFBZRHA2QUFzZFh5RTN1MmJhNHFHZlNsdWszMGRIUXFpMDF0dUxkSFBQZDFROUxzRzhVUWF6ZlNCd3hKeDNMd2gxYlFUNEcwa0xhdUVOaURnRUpPU0dsMS83Z0FSN3BROG9xdGp5MktZbnJyeFY5bnIvMThxNG9PLzhHcTFBTnU1b1g5K1FJQjJsUzQveVMrUzVxaDVybW4vIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1c73cb89-4720-48df-b44d-d86f8113d751", "record_id": "flaws_cloudtrail:0000003:1c73cb89-4720-48df-b44d-d86f8113d751", "row_index": 3, "timestamp": "2018-10-28T23:22:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1069, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1c73cb89-4720-48df-b44d-d86f8113d751", "eventTime": "2018-10-28T23:22:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJBYU5OdGRQUTFYVjVDN3VLNTFRS1dieUwraFRzdGdxcDE3VnlZSVBUUzE2cHhFUHBhemd4Q3YrYzZJUW8wdGd3VGRCbWhzbkFDMkx3SzBjbnRIam80ZmVtc2hBNXV5QVJqejF3K0VBS2tBdDBSTUVFdjUvMTk3MXRLZVVDMEhyYWZsSk1zeTVaUXhycXk1Q2x0NUJIL3MveUd1Z3hZS1UvSFBvaGlqOUdwem1aL1R5Q1hkeTFTRkRPeHJwVDZKRks2UDRNIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9dc6447e-4996-47c1-966b-b6146cf7f29c", "record_id": "flaws_cloudtrail:0000004:9dc6447e-4996-47c1-966b-b6146cf7f29c", "row_index": 4, "timestamp": "2018-10-28T23:22:05Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1066, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9dc6447e-4996-47c1-966b-b6146cf7f29c", "eventTime": "2018-10-28T23:22:05Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJEcURUa2hPeUNpRERtWWhNREg0WDYzN005RnRVNm55TDlkMmdwdWN3UlV5SDJGQlpiM0FoWk9QZHRBWmo5OWpXTXVFT1ZvZ3NRejNtcGphdnQrZFRDMVBmSlBCWGxHc2s3N0JyYUZBKzZCQjlmME0yMWlwVXEvNm12dllYb1R3SlhIbEt0N2F6bXJGY3cvWDY3ZlJEei9SMzd3eUxBbVNwUXhyWWFWTDM5eXYxUDVaTlZHS0N3VENGMlZZVUpJSEJib3RqIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3b7d10ef-2a1b-4556-9168-fa30e1cf7c12", "record_id": "flaws_cloudtrail:0000005:3b7d10ef-2a1b-4556-9168-fa30e1cf7c12", "row_index": 5, "timestamp": "2018-10-28T23:22:06Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1068, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3b7d10ef-2a1b-4556-9168-fa30e1cf7c12", "eventTime": "2018-10-28T23:22:06Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJuRks4L1NvSTYvNjZwVEpNcmZOaFhYcjJTTzIrQkFEK1MxSDlCdkd0Wkw0NlJ5OEFJZll1a3RWSXpuUXc5dUJHZ2QyVks2aGgvT1hDYzlGcGEyM3lpYUpzKzdCNUtadGJXL0xjVm14ekNONDFvVk9Mb0Z2a3AwZU8zZW5INEpDcDJGL0pEaFlqYWhRYUdmU09HeGRzbER0YlFQWDFObVg0OUJpTENteVBIMzdRQU45ZnRncTQzQ0wyR0xHN21yb1BZbnQ1IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9ccf6166-e20c-46ae-a8fc-e0e0faa054d1", "record_id": "flaws_cloudtrail:0000006:9ccf6166-e20c-46ae-a8fc-e0e0faa054d1", "row_index": 6, "timestamp": "2018-10-28T23:22:08Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1070, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9ccf6166-e20c-46ae-a8fc-e0e0faa054d1", "eventTime": "2018-10-28T23:22:08Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJCZGYvbEhvcFdkakpaQnpWVldjRi9SQStDQTRJbVl4VnhtZHpURzk0anlkbGVuVmd6eVlZUkVlSFlHcVJ0RXYzeDVzNGpORGx3ZEFaUG1QQ2Z4K2k2ZjFtckNYczh4c0QrVFh2TU1aekdaNkgxV0R6MnZiMkxsMm5SMmk3cnBqMjlMaFlBaGdCdWF1Q09lMVVIV0xYV2xMV2ZQTGRwdFZrWi9HOGdGaEMrSG9BL3ZiektxNXFxU3ZFZUp4akgxZ3BqeWU2IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "90c11acb-2b38-44aa-8e56-4b02baaf0e64", "record_id": "flaws_cloudtrail:0000007:90c11acb-2b38-44aa-8e56-4b02baaf0e64", "row_index": 7, "timestamp": "2018-10-28T23:22:10Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1069, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "90c11acb-2b38-44aa-8e56-4b02baaf0e64", "eventTime": "2018-10-28T23:22:10Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJtQ0w4NzVyTUVDSnVIQ3BxZ3BZTkRuaUJ1bi92NHFaVzd1KzZzRS9pOU11dm5ERmF0QkRHT0ZjME1CaGpJbVFjVC9wSXdpQWhsY2s5d0RxV3dSWm50clU2Z0hKeThTNXhpSzJoUXZpeXBEUzBYT09EQWVmQUp0dTlyQjJMSXBwdXlCaXJRZ0pDcWt5NEpkWk0wTlNNMDBsUnR3b2VSNHhGTGE0Z1BoRE5hd1NhMHI4cUhoQ1NDR2ZnajlrUCs4bVlhcGMrIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2010eeb8-237a-4cfd-8f51-2c038eca623a", "record_id": "flaws_cloudtrail:0000008:2010eeb8-237a-4cfd-8f51-2c038eca623a", "row_index": 8, "timestamp": "2018-10-28T23:22:11Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1069, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2010eeb8-237a-4cfd-8f51-2c038eca623a", "eventTime": "2018-10-28T23:22:11Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ0eHFHWGQ0aXJaV1ZxU204ZEdHR2xmZmVZMEx2VWEvbDVIQ0Zyb0k2djN5UExUbUxMbW1jUm5xMzd5TUIvUEhVVTh3azM2cnhZLytDTEtiY2ZHZC9FNi85WUIxa0JLV1pjRTExTWtrN0VQZlZyN2I1SFQ5bC9CNkRycFZYRTZ4VkhZbk5lanpLakVoOTVvNXFWcWNua09nUTNIUnA0TEpldE9DcWNHbUxxa1BBdEp2OXVSbk8yMC9lZDJPZVBSd09iY1J1IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "68ed2d77-83a3-4c4e-955b-2c11ad8d1428", "record_id": "flaws_cloudtrail:0000009:68ed2d77-83a3-4c4e-955b-2c11ad8d1428", "row_index": 9, "timestamp": "2018-10-28T23:22:12Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1069, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "68ed2d77-83a3-4c4e-955b-2c11ad8d1428", "eventTime": "2018-10-28T23:22:12Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ3Ui92UzhVbzBndGhXbjltNSt6OCtUTDhudC8ycE1uaDNhYzhtM2Z1NjZ4dWpTV0RzUUdvOS9WMjlxcTg4M1ltYWUvajBqVlh6bE1UaXpIQm5vL3h6NFlscE5wU21QT2lnUmdiVHlQVm9QSVdySnFuQnpkM3JidHJHcW9zb3lYTmVVZmZQaHRxZFlZS2ZlTytsQlF1b0VqbXgyRFBFMEhCb09hWWRNM2JSRytpM2lDRlZwLzY2ZTk2RkhrMkdRVDJVamp6IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d376fb0c-8825-496b-87e8-08a9765b471f", "record_id": "flaws_cloudtrail:0000010:d376fb0c-8825-496b-87e8-08a9765b471f", "row_index": 10, "timestamp": "2018-10-28T23:22:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1069, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d376fb0c-8825-496b-87e8-08a9765b471f", "eventTime": "2018-10-28T23:22:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJDaVVKWU1vZFVmWFN5MUp1UVBNN2ZkN1RhRzZjS21OSEdxZVoydExvcUlUOFNKOG5pTUVjRXpnR3dTRmFZR0tiekwwUmx6NkkxRmlzdkZFL0g5REhDNkJDSUxBaDJEaVBzRlRVUGVxMzNBejRxOTMwaXVXRndlekFHSWN1TStwQ2ZON3JXZ1V1SkN3ZGZyVksrNnhkcEYrTlRqV3ZyT05JajRubW9LditjQnIwWERrNUZ5clA5M0hCbHJOS3MyWGJCdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "230d7898-9102-44d9-b0b1-a19ad79f441c", "record_id": "flaws_cloudtrail:0000011:230d7898-9102-44d9-b0b1-a19ad79f441c", "row_index": 11, "timestamp": "2018-10-28T23:22:15Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "230d7898-9102-44d9-b0b1-a19ad79f441c", "eventTime": "2018-10-28T23:22:15Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI5TS9aRHdUL1ZZZW5LNlRUdTNtaXBvdWNoaU5SSTRVRGpjWEJVSVF6N1dYU1hXTjNIZEYyeWIvQ1U1WS96Qzdvd0JzMi9JN3NpaEVtZ2dZcEoxMlIyZ3poMGxld0xycmsrN0MxVit2d3JIMy9teTV6R1AvNnA3ZldpVHJLVU1oWFdyV2p1cCtBRndmZS8yK05xWnNob2p3NWsrNEFIQzNONmhERWxFWG0wbW42RHhRTk94S21NY0tGWFFBL0lJNFVOUkQwIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1b6c5f05-da28-409e-b136-33866a75e3f9", "record_id": "flaws_cloudtrail:0000012:1b6c5f05-da28-409e-b136-33866a75e3f9", "row_index": 12, "timestamp": "2018-10-28T23:22:17Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1069, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1b6c5f05-da28-409e-b136-33866a75e3f9", "eventTime": "2018-10-28T23:22:17Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJXUjFuTHNGZDRCR2lhcmY4Q0tlTWx2VGJodEU1TnhHZCtMU2hjN0FWYzFjQ000eW1yOWljRmVCZkdZbVdsNUxCd0FaQStZeHdRQWd6emhZMUFocTNTOWE5ejAyMUo5Y1YrSFA3d3NpS2dBNXdJMWREYy83di9ZM3BWME94QkYzYTc4YUhlZGgrTjlOb0FTaVQ3cEZKb1IzWHRMZkNSY1NMTytSTmx2eVArK2pKdFQ3MFR1Z0hTZ2ZIVmNHa09QQkdOSUtzIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f704e2df-8406-4a15-af48-077257ee7d7a", "record_id": "flaws_cloudtrail:0000013:f704e2df-8406-4a15-af48-077257ee7d7a", "row_index": 13, "timestamp": "2018-10-28T23:22:18Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1069, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f704e2df-8406-4a15-af48-077257ee7d7a", "eventTime": "2018-10-28T23:22:18Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2cG1IaEt4WlNLNVlBdzh0MExVdmc4TkFtcXk1R0lIZnd5WGxsWlNWU3pGY3A0K0VJak10Z3lhRE44VkE2L3I3a29aTENFOW80RWlrYWw3UDFWQ0lNRnRzL3NMd0o2c3ppQlg3OE85NFdTSU0xZytBdVVadUJjRG9vNG9zaVlIRjBZSkVrMXhEcWFPYnZGek5jWDEzVm5zNGZiaXAxeWR5NGp5UlpnRHlPQW1ncmlUemRST1pHb3ZTeU5wRFZoM2FweXZ4IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "18060c-9b83-4d81-a883-687a6579b55a", "record_id": "flaws_cloudtrail:0000014:18060c-9b83-4d81-a883-687a6579b55a", "row_index": 14, "timestamp": "2018-10-28T23:22:19Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1067, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "18060c-9b83-4d81-a883-687a6579b55a", "eventTime": "2018-10-28T23:22:19Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJZVGI5QTZzSTkzNHJ1M2FjU1ROTUVZZ2tUMUkxa0QzL3cyaVRhdzAzaXpCL05hN2hMeFk3YkltOHVFT1JjUXM4N3dLeWVOZ2t2TWNwUFZMMUlFSTlsZXFpSlBiYVBVUXZlK1h0UWd0RGRrcTZQMnlBcEJscmc1WTQwVjduZVpnU0lIRjZoS01UTTVJVFVaTFZ4Q0tvMlNiMFdENy9HYVBwaTV4WlRwc2ViRjBVckhHam5kV2NoSHdJYldpVEJMS1RqaHkvIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1cb1e2f0-3d78-4c96-9095-e88fa2daa9ab", "record_id": "flaws_cloudtrail:0000015:1cb1e2f0-3d78-4c96-9095-e88fa2daa9ab", "row_index": 15, "timestamp": "2018-10-28T23:22:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1093, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1cb1e2f0-3d78-4c96-9095-e88fa2daa9ab", "eventTime": "2018-10-28T23:22:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIyd1FJaTExVEVrdWRkaFJLMmZBODJHQUx6Y2srZDFTZkhBczd3OWhCZzRkb0RxaDRZcm5Ta0E1OXVVamJsQWR3b2FNMUR3NndUNTNNa215TkZGSGluaFVZRzRhNWRXOFgvWU5ndXBUUG5Kb2VMZWxvSkV4TDY2WGcyRGpSZVRGWEUvazNCa2hKcUhyUUQ2K1AvaGZzMy9vL0YwelVRTzl1U1A3VCsrWkx3Sm1maG9aR2hCR3dBNnFpdm9EZktva1MzZ3RrMDZHa0hDSWp2U1JpU1FJU3VnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e014b113-06b6-4bef-ba97-9e464dadb908", "record_id": "flaws_cloudtrail:0000016:e014b113-06b6-4bef-ba97-9e464dadb908", "row_index": 16, "timestamp": "2018-10-28T23:22:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e014b113-06b6-4bef-ba97-9e464dadb908", "eventTime": "2018-10-28T23:22:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJKU09SMkR0bmk4YTBvVnQ0NHB4ZEJBam02cmhOU1hrTXJkcWtUeUsydVV5Ym5kZkxZSTNONjhRU0o2U2p6aUtvZ0NDQ3BKZ3IrR0UzNXVqRURVNUZVNmFCOEg1YTZmODRYeGNMTjA4K2tvdkpKbjgxUkdiZzhXdFd5elFCTTdqVWxVaThQYkQrWmcwR0p0Z3dqSmhoVGczaEo0QlhuVFZmWDE4MXlsTHNTUUxuK1gvdnRJZmFvWUdDTGQ2U0ljSk0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "443fcca4-e042-400c-8ab4-c851751c2907", "record_id": "flaws_cloudtrail:0000017:443fcca4-e042-400c-8ab4-c851751c2907", "row_index": 17, "timestamp": "2018-10-28T23:22:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1093, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "443fcca4-e042-400c-8ab4-c851751c2907", "eventTime": "2018-10-28T23:22:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJHTFhpWmI3aUxZckt2UUp2eHBBeGdRNWhLcXpMUHNWR3QrOFpRZW1XbnBhY200TkVLbXl3Kzl1TGRDZFBqODhha3EvYU5qdHRnYjI3M1JNUjd1S2JBL1pya2xtNTVjRE9VcHZYa1g5M2x4c0R3WmJmcXlUYm9Mam9zZmZzampsYVVDUms1d3MyL0dMc0FKQXZqTHc2RktOZHlTM0ZmV2FVaW80WE9JVnEzU0tabGxhQXBNRmgraVFFRFBHeXExc2lGK1NGNkxnczdqaDNqV2tXSmJJOHNBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c68481c-4116-46fc-bb0d-b743d21814cf", "record_id": "flaws_cloudtrail:0000018:c68481c-4116-46fc-bb0d-b743d21814cf", "row_index": 18, "timestamp": "2018-10-28T23:22:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1084, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c68481c-4116-46fc-bb0d-b743d21814cf", "eventTime": "2018-10-28T23:22:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJLQUJ2QWkyNnprOVl3SHpZVS8wMzJaa3B2V0tRUTBzNUg3TC9HT1ZyL1c1clJrbjQ5cjFMOFIzV3J6RmU2SXhCOVhQTUlROGVHcnpPSGZyN0ljdGJ2Tm1sTG9JTG1WZzJCMUFlQUY0cXdhNG1qUEJrWmM1NVBHWkNwT0hNUEk0d1BnZEtFYWQ3VFJsdWtDdGVuZEZ3QTlJaUVqMy9vVUJ3VFg3OHZTRGJKenZnbmdtd1BJV3BJa3M4bmxtU2VJdDVyMEtJWVFORHJTbjF0WFJGclFvdlNRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fb318c88-a4fb-4095-b2c0-b4b01ecce28b", "record_id": "flaws_cloudtrail:0000019:fb318c88-a4fb-4095-b2c0-b4b01ecce28b", "row_index": 19, "timestamp": "2018-10-28T23:22:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1093, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fb318c88-a4fb-4095-b2c0-b4b01ecce28b", "eventTime": "2018-10-28T23:22:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJZWDRCcGxBeSsweHhrZ1F1VlBRTDhnZ0Y0R3p5ejBpV1ljL2VCejhqL3BLRk01TVZZazlkMmRaNDY0VTAwTk85eUlSTmY4UkdJZkRtemNacnU0RnlNNHBrYVlqWnFUT3ZEd2xWeGVQekxwYVNKSHk2QmdjYm9FcGpmd1MwQmQzajBMY1RBN25HNHhwZmQ0N1hwN2dBS3FPS0k3Z0ROaWhzWHlWdFgzbGlsaHdxc2pVOGRuaHBmNTZ2ZW5EM3AxZk01cDFvNTdoM0FZRlJvbnVkYk5POXdnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2f951031f-39d8-433f-b9fa-6c953ab4fb89", "record_id": "flaws_cloudtrail:0000020:2f951031f-39d8-433f-b9fa-6c953ab4fb89", "row_index": 20, "timestamp": "2018-10-28T23:22:21Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1095, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2f951031f-39d8-433f-b9fa-6c953ab4fb89", "eventTime": "2018-10-28T23:22:21Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJtN1lXM0lqZEVTWC9iVEZOcllWS09CL3ptditQRWg0Q0FuTnU4Sm4wMEc3N3YxMlllSjM2SG0yV0VvV0dGWUVtaUtxRldhdU5lWmsvVG81MDZ0NDRjTy9vZk42c3hzeVljZ3lCZklOeFdGWXRKYkoycGdUeWl5Q1RZRUV5dGRqcWhoOUIrRnBEM08raEI1NnFza3VWdXcxZFN2OERFNUlNR09tSnJQbVB0cndvQzBVNlhmekFvTTFDRWlJc1Z5bDh1ZW1oeWZmbnRvaXphdWEvK29nL1JnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bbbbb174-e6e5-4876-a151-da05af346763a", "record_id": "flaws_cloudtrail:0000021:bbbbb174-e6e5-4876-a151-da05af346763a", "row_index": 21, "timestamp": "2018-10-28T23:22:46Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.252.98.231", "user_agent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 769, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bbbbb174-e6e5-4876-a151-da05af346763a", "eventTime": "2018-10-28T23:22:46Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.252.98.231", "userAgent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c4c0aca4-ef68-41b7-9aaf-364a6679e710", "record_id": "flaws_cloudtrail:0000022:c4c0aca4-ef68-41b7-9aaf-364a6679e710", "row_index": 22, "timestamp": "2018-10-28T23:23:53Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.252.98.231", "user_agent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c4c0aca4-ef68-41b7-9aaf-364a6679e710", "eventTime": "2018-10-28T23:23:53Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.252.98.231", "userAgent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "78a9489d-bcd1-450f-9b4f-7b655b250b75", "record_id": "flaws_cloudtrail:0000023:78a9489d-bcd1-450f-9b4f-7b655b250b75", "row_index": 23, "timestamp": "2018-10-28T23:24:26Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.252.98.231", "user_agent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "78a9489d-bcd1-450f-9b4f-7b655b250b75", "eventTime": "2018-10-28T23:24:26Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.252.98.231", "userAgent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1557a257-8f62-4532-9da7-228ffcbfcfa4", "record_id": "flaws_cloudtrail:0000024:1557a257-8f62-4532-9da7-228ffcbfcfa4", "row_index": 24, "timestamp": "2018-10-28T23:24:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.252.98.231", "user_agent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1057, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1557a257-8f62-4532-9da7-228ffcbfcfa4", "eventTime": "2018-10-28T23:24:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.252.98.231", "userAgent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIxR2FZWG1QdUl3ZE93eHNxSjVDajRMRy81YlUxeEZiN2U0MmZNeVBFRzk2OGlKN1NQMHJMMU40S085cWIySTE5a2g4MEVMd2tYdkVjTkE2cjl0VkxFVjBteXh5cWVUeU5ueFAyZk0zQ1Jqdnd3aEdEZFZFR2RnWjdTVklvcGEvZnpHMitaa21WY3NJcExkS3hNTGN0SUp6NXdTTGcrQnpqNzJwSWZtdzdxMkY1VytuRS9rM0szdmtzOTB3ck1qQTdVUTBYIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "280a9e39-8c2e-4e9e-a123-f2d4e59fb882", "record_id": "flaws_cloudtrail:0000025:280a9e39-8c2e-4e9e-a123-f2d4e59fb882", "row_index": 25, "timestamp": "2018-10-28T23:24:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.252.98.231", "user_agent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1058, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "280a9e39-8c2e-4e9e-a123-f2d4e59fb882", "eventTime": "2018-10-28T23:24:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.252.98.231", "userAgent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2WEZWSytpeUxoT1J5VEFtRlNucGQ2eWFtaWxLRDdYRHJrZEpCNkRlWUErQUFxRWEva1dMMVZLYjlHWllKcHF5dDYvdXE1Q2RVUDhOUFRsYjVoSVdLeUdCcThkZHVPOWJBSjB4UkRQK2s3cGRZb2t2eWJ4LysrNTdFdHBZd2F2eFZmSzlNdUhpNVNKUDdRMVV1VW5hK2FibFJNQ3hOWXRnVWl2bXp0aXBUN1BIckZya3psUEZmYXdRTXlxeGtVa1M4WWdSIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "de8efb7b-4515-4313-919c-181413f85336", "record_id": "flaws_cloudtrail:0000026:de8efb7b-4515-4313-919c-181413f85336", "row_index": 26, "timestamp": "2018-10-28T23:24:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.252.98.231", "user_agent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "de8efb7b-4515-4313-919c-181413f85336", "eventTime": "2018-10-28T23:24:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.252.98.231", "userAgent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJHU1J0bTJweDMvR3p3aGZDL2twQnBNOXlsNHA0WUdZajIxTCtTRUc4VGkvVUFuQjkybk85Y29JVVVBcTF2aDF1Q2pVbmI0eE1BZ1orQzI1eVQxL0t0dVZ4NG1Eandsak5TME56d0NOQnAwdkMvZmZJc0hla0FwZE1tK0Q5dHgvb3kyMWxoZU5kNEZZelg5SURidjZRNU9VVFdYSEYrVnFQUnUwV0JYVnBIOG1BNW14V1QyMWpMSkhYZ2RMYng1RG9xR1N3IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4db9d059-17f0-45a0-8ca9-91ce85321d3d", "record_id": "flaws_cloudtrail:0000027:4db9d059-17f0-45a0-8ca9-91ce85321d3d", "row_index": 27, "timestamp": "2018-10-28T23:24:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.252.98.231", "user_agent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4db9d059-17f0-45a0-8ca9-91ce85321d3d", "eventTime": "2018-10-28T23:24:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.252.98.231", "userAgent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJzM1ROQ09SNTlqMlN0RGFMMXpYY0dIWURwbTZzMEZ4ZUNNWk9UU21kODhqMjgrK2dlSGV4U2FSTnBVTmExWlZ2cm1sYUgvd3N1a1Jwc0xJOERaVEF6RTg5c2QwUDlpU2ZpMEZNSlhGUXVEZldEMkZmOENpYTRoa3lMeGtwOEo2WHlmbnp1SWRMVTJaRndpbHVHZVgva0dOZ0dpcWZXckhNWGgwWkxVdjJhZjJXazBZUDFTOHN5REZDTGx5WWFFZmNNUWJ5IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ba173662-5f09-4218-898c-4a7cb8726cc0", "record_id": "flaws_cloudtrail:0000028:7ba173662-5f09-4218-898c-4a7cb8726cc0", "row_index": 28, "timestamp": "2018-10-28T23:24:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.252.98.231", "user_agent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ba173662-5f09-4218-898c-4a7cb8726cc0", "eventTime": "2018-10-28T23:24:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.252.98.231", "userAgent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJsWlpYWXB1QVlYZ0hBZVRYN1lsVllwQkhUSTRIbWw5RmIwWnBHcm9ZNmI0YTR5TzYyNnVFS210WjRmYy9RVktQeEt1dkhiamlzbUdKNUo5SzVSaU9JU0RZZ1UwbVFZKzhSQ2UrTTg0YnRzNHQwR2VRanlVRzVLMGF3Y25nMEU0OHVqUWpSZHhJaVJhWkpTN2c0VlF6YlROUk5oYVkvdmZrTWVIekFuY2NGU1hBaGpyZEtRYThYcG1RblBva1FGRDFWMWRlIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b7f1ad42-bb6c-4fc0-8cfa-1e97a8a0ef6c", "record_id": "flaws_cloudtrail:0000029:b7f1ad42-bb6c-4fc0-8cfa-1e97a8a0ef6c", "row_index": 29, "timestamp": "2018-10-28T23:24:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.252.98.231", "user_agent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b7f1ad42-bb6c-4fc0-8cfa-1e97a8a0ef6c", "eventTime": "2018-10-28T23:24:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.252.98.231", "userAgent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJndGdnTHYrOEFlb040ME9RYXZHYmhYQzI4amVEelExWkl0eU9ZNUFydytKdU1hR1Nib21JU1RWdGhKUVRncUJqQ0U5RUc1VXVSMnVncGMyeE9pMWxGR1JTMlBQTkF6a3NYeTM5UmNyQXRrZ1lITWlHaFFLNDhJVjNodlRERVJDdUJVMDNIcHNmQTZILzFMV2JGVUtIVnJnaHpJWWZ5a1I5VHNsM2Nnc2pQb2hzYXQzSTlORGUySm1qWktTQUFpT0E3Z3kvIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "679d85cc-c0bb-42f1-9d82-12c5cf832ff3", "record_id": "flaws_cloudtrail:0000030:679d85cc-c0bb-42f1-9d82-12c5cf832ff3", "row_index": 30, "timestamp": "2018-10-28T23:24:45Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.252.98.231", "user_agent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "679d85cc-c0bb-42f1-9d82-12c5cf832ff3", "eventTime": "2018-10-28T23:24:45Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.252.98.231", "userAgent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwNTNtVmtXeXFUa2hxYkZZNm5wMnhFRG12RnowVjlqWElYM0ZpWmdRNDR2RlJKcFlna0h3d1pJM3phOVZ4NGlubkdaaXhRdFYvVFEyYkpRN2g1N1JXRXQ3RmtDWWNiQUFaZTk3Vm1QWEk5KzJSWCtkYkpFcnBiL1BtejVLalpmVHUydzY4NWhFaW5FN0RUaU9hSnVxOHNIVUJmaWxKMXFVTXhHWllDdWFvOVVGc3dVam05T1ZDclhwL04zREZYanh1WXovIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f433f10a-8af5-45d3-9a98-dff53b802e83", "record_id": "flaws_cloudtrail:0000031:f433f10a-8af5-45d3-9a98-dff53b802e83", "row_index": 31, "timestamp": "2018-10-28T23:24:49Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.252.98.231", "user_agent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f433f10a-8af5-45d3-9a98-dff53b802e83", "eventTime": "2018-10-28T23:24:49Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.252.98.231", "userAgent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIxYnAvZmZmdjhPTFpNVDZtdFRCc0tRRnZtOXk0Y1YxU0N4VFZWREE0aitWU3QxcngwK09ZejJOVVVXaHM0ejg1dDR4bjZ1Z0VyUzRFV1ZOd1RwRC94Mk9TNzB4eFg2MjdnbGpldjlzWFVwcjYyM0ZTem9RZG9OT29VcjFzMW5UbStJcFd4K3dmbDZsZ24vQmJzU1RZbk9NQWszS1UzcVpYcXhsMU5KdkE4VER1TVhHM1JzL2F1eTZRdXN5V3M2SlI2TnRTIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be4d02b4-18e7-44f2-927f-6957451d4306", "record_id": "flaws_cloudtrail:0000032:be4d02b4-18e7-44f2-927f-6957451d4306", "row_index": 32, "timestamp": "2018-10-28T23:24:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.252.98.231", "user_agent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1058, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be4d02b4-18e7-44f2-927f-6957451d4306", "eventTime": "2018-10-28T23:24:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.252.98.231", "userAgent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJrQjI5cGFNUHpBcUZiSnJFRzhDZDJjd3dTZ3hSWGRKL05PRFZhRmcyVHhiTXo1MEFVTE1TbWpMSWdzdnRNSHZSSFlydTgxNld4WG5heEhKVmlzTDNEdjIrRWRaNVN6clJJejFqZkR2N1VQOXlsNThZNWttdEx4V3pSVnJhbDg3YVhMbjNBNGo4SXBxOXhHUlU3ZmFjUjFuTGdNUXprWktoTTZIT1FtVUdCUWdDZ1JVb2w1ZExiaFBLZ05Wc1g3SHcrUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e38b95a4-b0b4-4939-8026-fb8325aaf157", "record_id": "flaws_cloudtrail:0000033:e38b95a4-b0b4-4939-8026-fb8325aaf157", "row_index": 33, "timestamp": "2018-10-28T23:24:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.252.98.231", "user_agent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e38b95a4-b0b4-4939-8026-fb8325aaf157", "eventTime": "2018-10-28T23:24:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.252.98.231", "userAgent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwUnlHQzNJV3FKUENMeGJoWXNHZG9xNU8zc0hvSWNVdys1a05uejl3YnZmM3h5YUlqckRxd3p5TjhuaEN0WHRKcEdYUUllNEFkaHVDNmwvNERLeDYxK2YyTndaKzUwWStVeGFkZTU5Z2tBT1RYWmNsT1AwSEJjUUVYWU5rVXE5S3VSRjhtbjNsVU9nZjVEZ1NxK3hDdVhESTVjaDlFWDhvaFZwR2t4Q3dUSU1JbzlPazhTWHBva3hudWhPU2ZYdXRDLzNXIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3e99020e-914d-48ce-92df-8c7d67d99bdd", "record_id": "flaws_cloudtrail:0000034:3e99020e-914d-48ce-92df-8c7d67d99bdd", "row_index": 34, "timestamp": "2018-10-28T23:25:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.252.98.231", "user_agent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3e99020e-914d-48ce-92df-8c7d67d99bdd", "eventTime": "2018-10-28T23:25:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.252.98.231", "userAgent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI0ekorajdDcjJWTU5VbVUwK01MaEVmOGl2YW43VjRxR0ZDQjFpTFpSWVgyd0phR2JkU0lHd0p2cVlrSUphbkdFNXViRjEwaEhnakZtNGZLcHEydTNBZDJ5TU1KcXpvaC9oOGMwdTBOOGxZeTlqQzBZMzBvYWlDN1dscDIvZTlyQVVxZk1vQW16TVg0bUlZamVXN2tFR2NTaC9XMWc1OXJiK01xenlLaTNtdmZhdWlVZ1d2WkxiOXUxS1Z3OEpVaWthd0M3IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "833f67de-6412-4871-b88c-9ba0816d8110", "record_id": "flaws_cloudtrail:0000035:833f67de-6412-4871-b88c-9ba0816d8110", "row_index": 35, "timestamp": "2018-10-28T23:25:07Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.252.98.231", "user_agent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "833f67de-6412-4871-b88c-9ba0816d8110", "eventTime": "2018-10-28T23:25:07Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.252.98.231", "userAgent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ3TXBHeVlDNVBheEsvd2lnVDF3WGtieDRhZU9kenlBLzdxMnpHRld4bXI5TkwyR2JNY0NjUVF5b0ppQ3FGOVc2NTRCRUJSSE9GRDZCbytvRFB6aHErVk9JNTAxWm5STEpnblZwb0xudkc5Z28zenRiYUd5cHNmcEJUSnRIejhxbXZpQkZPa1dteVNVeFdXYnArNHRXRW9xUnhDZENCV3U2bUtORzhLTHl2c0dJNXF5Uk40Snh2Sk5wRjRBNks3S3phZXpHIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d183082be-f671-44aa-abd3-1dcbdc044b7e", "record_id": "flaws_cloudtrail:0000036:d183082be-f671-44aa-abd3-1dcbdc044b7e", "row_index": 36, "timestamp": "2018-10-28T23:25:10Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.252.98.231", "user_agent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d183082be-f671-44aa-abd3-1dcbdc044b7e", "eventTime": "2018-10-28T23:25:10Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.252.98.231", "userAgent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJWM2djS1FNK1BYRFdSUzlncHZNcFpUZ1gyWHR1eS9GVHFpRW9ZalRFMWVTZ2EvV1pxUWdTM1dUV3VKbWpSVnhjTVlnckFqZ21VTlNHNDVIL3EwaHVDeDBMUkZITzlMQXlYanY4MnF0WjVtWmdkQXRCUTdWcEgxTXN5Q2hZQXhqckI2MlROSHJpbW9YRGtNaWwzck0xVUppbDJwZVFpR1RyOTYrZEZvUXBnamlQUEtuZkNLN2NtSHJ0UVhKMU1Kck5TaytpIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bebb61f7-f95e-4722-a48d-c1dbfefa310d", "record_id": "flaws_cloudtrail:0000037:bebb61f7-f95e-4722-a48d-c1dbfefa310d", "row_index": 37, "timestamp": "2018-10-28T23:25:20Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.252.98.231", "user_agent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 767, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bebb61f7-f95e-4722-a48d-c1dbfefa310d", "eventTime": "2018-10-28T23:25:20Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.252.98.231", "userAgent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8a0efdc2-557a-42a4-b1cc-4086ff3a5673", "record_id": "flaws_cloudtrail:0000038:8a0efdc2-557a-42a4-b1cc-4086ff3a5673", "row_index": 38, "timestamp": "2018-10-28T23:25:28Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.252.98.231", "user_agent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8a0efdc2-557a-42a4-b1cc-4086ff3a5673", "eventTime": "2018-10-28T23:25:28Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.252.98.231", "userAgent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b4b6fa03-3610-4e38-94d4-d3328a6130b0", "record_id": "flaws_cloudtrail:0000039:b4b6fa03-3610-4e38-94d4-d3328a6130b0", "row_index": 39, "timestamp": "2018-10-28T23:25:35Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.252.98.231", "user_agent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b4b6fa03-3610-4e38-94d4-d3328a6130b0", "eventTime": "2018-10-28T23:25:35Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.252.98.231", "userAgent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "38982b-8699-4c73-aefd-cf742c0004bd", "record_id": "flaws_cloudtrail:0000040:38982b-8699-4c73-aefd-cf742c0004bd", "row_index": 40, "timestamp": "2018-10-28T23:28:35Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 759, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "38982b-8699-4c73-aefd-cf742c0004bd", "eventTime": "2018-10-28T23:28:35Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e6aed33a-1e0a-4bae-86a6-f06f2dadd87f", "record_id": "flaws_cloudtrail:0000041:e6aed33a-1e0a-4bae-86a6-f06f2dadd87f", "row_index": 41, "timestamp": "2018-10-28T23:29:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.252.98.231", "user_agent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 780, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e6aed33a-1e0a-4bae-86a6-f06f2dadd87f", "eventTime": "2018-10-28T23:29:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.252.98.231", "userAgent": "aws-cli/1.16.43 Python/3.7.1 Windows/10 botocore/1.12.33", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "511c4e52-0342-4174-b223-a3fa2cf2b9f4", "record_id": "flaws_cloudtrail:0000042:511c4e52-0342-4174-b223-a3fa2cf2b9f4", "row_index": 42, "timestamp": "2018-10-28T23:30:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 778, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "511c4e52-0342-4174-b223-a3fa2cf2b9f4", "eventTime": "2018-10-28T23:30:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5a7e6df7-475c-4f55-a17d-335e38a88e40", "record_id": "flaws_cloudtrail:0000043:5a7e6df7-475c-4f55-a17d-335e38a88e40", "row_index": 43, "timestamp": "2018-10-28T23:31:11Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 744, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5a7e6df7-475c-4f55-a17d-335e38a88e40", "eventTime": "2018-10-28T23:31:11Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "922916c-14dd-42d4-a639-7a19a5de4377", "record_id": "flaws_cloudtrail:0000044:922916c-14dd-42d4-a639-7a19a5de4377", "row_index": 44, "timestamp": "2018-10-28T23:31:15Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "922916c-14dd-42d4-a639-7a19a5de4377", "eventTime": "2018-10-28T23:31:15Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIzQWZqVnN3RlUyOUNKTzA1YTl3Y251UkhwdWs4SkR5WTIySFFmYmVPbThEVER2Tnp0MjNTVjF2ME52NFg0a2EwMElYYXpQb0tkSkh4Q1BjYS82LzliWFhvMDEveFA2QktIeWtva2cvcUNWNHNHQ3JlMGExUGdNTzBnM0MzOEZQWXhTd1RZa0tadmRMMHNyWHFjRENDUGI2SFZGbW83aUJaeDE4T3R2Wm1EUDFNQ0VVM3NNYXByVzY5b1BhU2dtYUpGQmRFIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "62d0bf49-f1b9-41c7-ac99-9a4b0481bb18", "record_id": "flaws_cloudtrail:0000045:62d0bf49-f1b9-41c7-ac99-9a4b0481bb18", "row_index": 45, "timestamp": "2018-10-28T23:31:17Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "62d0bf49-f1b9-41c7-ac99-9a4b0481bb18", "eventTime": "2018-10-28T23:31:17Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJQSkNNZUZuVnh4SEUrY2VDL0YyaHp5LzZaMms4dXg3RU1SaERqL3lXS1FkWDBJNHI3clFLS05lK0ZBMllPSEI2SGl5Qm5CZUVnZGlDcWw0dXloLzdkcW1KVTN4VGNzdWpQbkhoQmhLMy9ib3BHRkNZcEk3cDliUlIzSWEyUTd1dElPQjlHeGplMEREVG9iSTk0ZzFxOHBNWCtaUUNpcTlQNkFyeS81aDI0ck9qYUZOcndwTkFjalJHT1ovSEtscHV2TVhRIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ab9bb04a-61da-4983-85f6-dec69619f", "record_id": "flaws_cloudtrail:0000046:ab9bb04a-61da-4983-85f6-dec69619f", "row_index": 46, "timestamp": "2018-10-28T23:31:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1051, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ab9bb04a-61da-4983-85f6-dec69619f", "eventTime": "2018-10-28T23:31:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJQd2ZTbERrVGpubTZ6cytKQ1BnTlVYUzBQVXNaM2hqQUxURXFkNUY4aTQvQlM5aWFadCtxQkdGS3Rvb2FqV3RqTlZKa0hnOXlIQjZVMUpOMHZtL3BEb1drMkdhaDkrNE9rbnF6M0dxUmVJNzdJSmJtVGVwRUs0OGdzaG5idFRrRlRaQ3Jab3M4WmJiVUttK3dENFRlSGlhOTVtM1E4UWp0K3FmWnhtdzRyVTNzVWNwZ05pcU1PeVR3UVpRV3FwQ1lQWG9XIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e058afcb-3b92-47c1-9641-a3a3a8258eb5", "record_id": "flaws_cloudtrail:0000047:e058afcb-3b92-47c1-9641-a3a3a8258eb5", "row_index": 47, "timestamp": "2018-10-28T23:31:22Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e058afcb-3b92-47c1-9641-a3a3a8258eb5", "eventTime": "2018-10-28T23:31:22Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJhaWRZYXVUZTVsb24wTDI2d3NFRXF2dEVLaEFicGNNS0hQOXlJWHdWRU5WUmhKSzRhQ3BObjkzMkN4YlBRaVBiRWMyUWgyUHV0cmJKWitLQ0krNGhHeDY4MnBVTGRacFlIcjQ1ZFlrK1JQMkFUa0lldkxNVERzV0F5TmR3WHNDUmdHaEFzUlRIQitlbnlORGp0MEFWYzNoNFVhKzl4ekVoV1VPQ2ZiUGFteG1QVjhBUUVEZVY1cHV6N0N5UUFXc0I4SVJpIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0c58a9f1-37b4-4e6b-b08c-aec65e3af8d6", "record_id": "flaws_cloudtrail:0000048:0c58a9f1-37b4-4e6b-b08c-aec65e3af8d6", "row_index": 48, "timestamp": "2018-10-28T23:31:24Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1056, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0c58a9f1-37b4-4e6b-b08c-aec65e3af8d6", "eventTime": "2018-10-28T23:31:24Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ0aUhxOGZqbytWbXRobmdIeW9YMjBlNFFiZ2diRUR4ZmUvOU1LWmh4S0FLd25MU1hpZFl3Nk5UUGhGRkFST05qdzh4SmdHdWVZTkpoVkpoeWR1R1JIYnpNN3VuN2dFTWwzdGUvMEhETHFlbWwzd2Y4RjdScit3WmpKSVYrZUdkaVp5S0lEWHJFQ0xPUlFXVHFxSjBUdWlQcFN4cHNpbkJsVjIxUU1TeTlka1pFaWRVUlpmQnR2TG1ZcXFNd01SR2NRbFZpIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a8d4d057-e7f4-42d3-b906-ba898f9e2d83", "record_id": "flaws_cloudtrail:0000049:a8d4d057-e7f4-42d3-b906-ba898f9e2d83", "row_index": 49, "timestamp": "2018-10-28T23:31:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a8d4d057-e7f4-42d3-b906-ba898f9e2d83", "eventTime": "2018-10-28T23:31:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJCSTBBTlNoa3VacktHVlJUV3BXRlV1U3dZR212RGljVy9YdFF5L1ZSOFo1QUpnQ1ZHNEhWamRSRnJnODVvdGlySUphRGZwTyt6ZE54bDUwZUJWMDg1MGszZVZ0U3p4YkVtOGx1YVBMMnlZUEw0d1NaeHJ1bk1BMWg0c1RxdEpNWDFsckQ5T3dkTGRoYjg0OXBuZFJFMithZUZ6WWZkWEVUSnh0OUcwWTFtcUpVZG5mOS9ZYVMzYnFxS0lLcXlqTWx3S0NwIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f68d484c-cd1d-41fd-8ac9-dee2ac91cb38", "record_id": "flaws_cloudtrail:0000050:f68d484c-cd1d-41fd-8ac9-dee2ac91cb38", "row_index": 50, "timestamp": "2018-10-28T23:31:27Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f68d484c-cd1d-41fd-8ac9-dee2ac91cb38", "eventTime": "2018-10-28T23:31:27Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ0OWFIOE0xZ0tuR0xxR1FZNjA2enRaWitnenJiVjhlSnV2L1NFUVhsMFJpS01aOFRWSjFxcUZPL3ZTeTZQbmJmdW1UalhLdE43TkR2eTVncERmeDlSaTNTTG5PeEJlRkFYZCs5THlXam1EWkFNM1M0cFYvcVhwb0Y4ZG5seGtFMjlmYmVob2lRaWRjUlRObEtTVFZ1WWM5Y2NsZEl2Tk9aclNMdUVjOENTWVN6UmZlZ0dJWnlWRndKcXVMQW1XeVlreGhGIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dca40f88-075d-451a-9792-863c61e092992", "record_id": "flaws_cloudtrail:0000051:dca40f88-075d-451a-9792-863c61e092992", "row_index": 51, "timestamp": "2018-10-28T23:31:28Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1056, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dca40f88-075d-451a-9792-863c61e092992", "eventTime": "2018-10-28T23:31:28Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJpN3lZKzdsaWw1YVVsNVRTSU1QOGdXYm9CektPWGM2cUIzOVphKzlQeE05Z2FmNmxGUDRPN1JnYW15bmY2YjdqQkwrMjVVUmY0YmVFdU1xNDllVmJ6QTM0dDV5TE00bnVZdm5WbEQ3WGVJMUQvMkJ1WUdaWUZqNHBXcUE5dXN6SkdEa1EzUTg3dFRGUk04THg0ZUdCdk96dTNZczluYjR4QW5IeHAvUmYxbXFsN2EwNUxuVFg4K3JFa2NZOVBzaDNMTGQvIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c2acad38-f267-4af1-8e40-5aa34edd3186", "record_id": "flaws_cloudtrail:0000052:c2acad38-f267-4af1-8e40-5aa34edd3186", "row_index": 52, "timestamp": "2018-10-28T23:31:29Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c2acad38-f267-4af1-8e40-5aa34edd3186", "eventTime": "2018-10-28T23:31:29Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJlSE1XaGtubjcwSUw4cmNBbEIwb1kxMG5QN21BRWdMaHpGR2pNNjFBTDNZN1V0TEhFeWlrYnkzdnhlQ2RzWEE5T2RoTm9sK1JwN014U21VOHo4SmJuOVR2b2VCZ3J3OHY5UThrbG52a1VZTWlYa2dhVXI0YnZabzQ0UGhwRkN1Q1NwWFp3eW1xdS9nSUQ5UnNQa1BTZUtrajk2eWd3MnFSR2tvYk9ETzRkaGwxOXdxNHlVazZ1UU5iZ1N4dklzcDdHQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f5cb6702-7d1c-457d-90b3-7106c17d081b", "record_id": "flaws_cloudtrail:0000053:f5cb6702-7d1c-457d-90b3-7106c17d081b", "row_index": 53, "timestamp": "2018-10-28T23:31:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f5cb6702-7d1c-457d-90b3-7106c17d081b", "eventTime": "2018-10-28T23:31:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ5U1ZCeXJHeWozbFlmeitRUUtHb1FSMzdWaCtCdEliYklxa3FGTWx5NnhkWVgvRDRmM2swM2N0R1FFQWJLRVlrcTQ5Z1owZVpyUFR5cHRhYjFsQ3M4elpLSTEycHNjTHRXcHZ5TnhiaEVsQ1E1bXZqQ0YzWTJoQlBxM0R6TmQvZ0pwRGhua3pWQ3BOa1RsQ2RKcHdXUHhHRkNUWGU2WUp4amVub0k4WldMS1pFR2Y0MnUwNXNUa0QzS2x3MGltbWtsbmsxIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e018a206-2dd4-4821-8d3d-4e7972b11146", "record_id": "flaws_cloudtrail:0000054:e018a206-2dd4-4821-8d3d-4e7972b11146", "row_index": 54, "timestamp": "2018-10-28T23:31:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e018a206-2dd4-4821-8d3d-4e7972b11146", "eventTime": "2018-10-28T23:31:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2TGs1Nmx3NkdXZlAvNmdoczMxNnJJa05OTmNPdUp6anJ6QWgrRkJTQUZMb2hpUEVoeFZHM3p1Z3RvZ1cvU3o0WmFYaUUrUzBmSk5yanMvL3dsL1owRGE3MkhYcXJTVVZ6M2llNHFLR0dhS3dRTjdLSXhqZGJiUG1Kdk5pQ2VpSHh5R0tLeHQzL3VwZFJsQmU3UVd0a2U4ak1oMWFCT1RuU2tySjZIckl0OWh2OFJiRExNY0hhZjhQVHhkQWNnbWxVV1gvIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bd620c8f-cd21-4679-ac7b-72d5c7343a48", "record_id": "flaws_cloudtrail:0000055:bd620c8f-cd21-4679-ac7b-72d5c7343a48", "row_index": 55, "timestamp": "2018-10-28T23:31:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bd620c8f-cd21-4679-ac7b-72d5c7343a48", "eventTime": "2018-10-28T23:31:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI0Y0Z4UnY4T2U5TzBTWUw2bTB2NmU0R2lLMGxsU0ZjaU1nWm04MUlTcU9UbDFaQmZYOVBvNTNGTFo1Nng4ZldISDNnbHFSZnJwdC9DNTNBWGdGZHZheDdXeTFXTnNaQm9wSmIrb1BSUjJQSUprTTFJL3BqT3EyaUU5WVhVM3hXS1JNYXJGSkZrRVVJWUxIUGhXSDVEYWs2RmlBOXNPdW9EVkcza245TWJxeXU3em5WbVJGRHZoQk1RSE1UOTZWM1B6K0JJIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6e990822-9d53-43c9-a470-6a07caaa2163", "record_id": "flaws_cloudtrail:0000056:6e990822-9d53-43c9-a470-6a07caaa2163", "row_index": 56, "timestamp": "2018-10-28T23:31:35Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1079, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6e990822-9d53-43c9-a470-6a07caaa2163", "eventTime": "2018-10-28T23:31:35Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJpbEtSSmhUMmRkYzRHVHZWQmU2a2cyUkVBSHlDU2I0Nk5NdnNiTHVvQWJxOUJPMm1CeUpCSVNtbE53YWJ3Rm9VUnFwZDdGWndsQ09hRnhHT1UxbFAzdEpvRi92R2hXcjIwM2daWHBoNmpaNkZhYnhUMldWbEltSjg2ZEc1ZHhCTSszM1hnTlI5cldDVXlIeUxQVENBa0ppWDZBcTRSM1oxdDg1OFl5MkVaaGNWdmNjcm1oOGhQLzNpL0poZ2R2VllzRGoyeHUzOFlKNkdlaXRhcEtBMDZBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4795dcd8-88cc-4843-880f-d02f875e4ac6", "record_id": "flaws_cloudtrail:0000057:4795dcd8-88cc-4843-880f-d02f875e4ac6", "row_index": 57, "timestamp": "2018-10-28T23:31:35Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4795dcd8-88cc-4843-880f-d02f875e4ac6", "eventTime": "2018-10-28T23:31:35Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIwS3NlZ1NiMWYwQjg4OFBVdGpheUI4QTVUS0RWMG0wSFl2b2V0VFkzTnZnVGxBODBISWp1a3dDV3RQck1FRXJmNjFaYVMzNGlSVWluaWxQNTQwTm1UM04ycC9mZDk3c3lGWmlxQk5zZk9Oa1dCSEF2akdEWlpKNXRsazRyVzJWWGhpUTNTcEJWL0VBQmRXQWNZbThSUHF6RndDWHFWTWVpb01Da0dhaFBidUdhQjk2QWVVdkgveUE3WjMrNS9oTzA4eWF6IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "809352e5-0444-4a52-9b04-bfccfae370ce", "record_id": "flaws_cloudtrail:0000058:809352e5-0444-4a52-9b04-bfccfae370ce", "row_index": 58, "timestamp": "2018-10-28T23:31:35Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1047, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "809352e5-0444-4a52-9b04-bfccfae370ce", "eventTime": "2018-10-28T23:31:35Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJGUGNvWVVHMGxVN3J0Q2xOSm5ZRE9uUHd6SHkxdkJXZjBkc3YyOGV3c201YjB4Y1JlQzZIdnFwb1NMazlaTmVCS0pSWExXcDFQeHlGdnR4eXBDbTE1U3c2RFJseE1XWnBEUGZkQnBGU0tuNnE4YzYvR01rS21HSWFUbElkSEs1Sll5T0syU0EvU1BheExESnZidFBQalpmMUp2UUFoaG9YU2h6RHp5RWI0VmZvWndMUHhKNXZDSlJwWmhRMzhiSDYiLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "edd02b81-59aa-429a-bf6f-c4d1f3e6e36f", "record_id": "flaws_cloudtrail:0000059:edd02b81-59aa-429a-bf6f-c4d1f3e6e36f", "row_index": 59, "timestamp": "2018-10-28T23:31:35Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1079, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "edd02b81-59aa-429a-bf6f-c4d1f3e6e36f", "eventTime": "2018-10-28T23:31:35Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJYWjhSaDhJVUwxcEJDd2NjS0Qvc0E2b2ZYUG1FOFFxY1B3NzBGMTJLanMzOTRreGI5eVQvSlN5cVY3RzU3Sy90bWZ2aXEzcUZ0a0JpWUZCT0dnSHo0WXZ6eEp2Ymt4M25UTDJNekRsSFRHbHVrOUZKZ0NZdVRZTkluMTRUYVN1WjJOYjY0VWJKbHVwQytVd0wxL1ljQ1VYeHhEakJRNWZ4bUlSMEw3cjFTK2RkcC9mL0hxZzlaVmtDM3BUL1VOK3R6NmdrbFZjSG1NdHpDTFcydTdTZVFBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "15862d2-eaa2-4367-be1f-b9191dc593db", "record_id": "flaws_cloudtrail:0000060:15862d2-eaa2-4367-be1f-b9191dc593db", "row_index": 60, "timestamp": "2018-10-28T23:31:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1078, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "15862d2-eaa2-4367-be1f-b9191dc593db", "eventTime": "2018-10-28T23:31:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJxT1ZTMzNpVVFaMm5yblQyc3hGclMyeUMwSDdXRG9lTXdYUEhaR09RSVZFVEloZ0pLRXdXd2xMbWZEMEgwZEdTOEVyTWdHdCtXSFFyak5HZnV0YTVpUWtqaTFvODRQS3I5aWU2SXNyVG5HbWNLZ3VNSE1remtoU2JMbmI0NUdFanRQc1B4OFg4V2lEVEZ2Ly8xSFdWR2hnZGp2WGI3cm9mNEhLUGVLS1d0ei8xd2F6Y1VpV3B5MFJIaXpURktRaUQwRTlCWEl0d1phVTJkMVNzZXlyZ3RRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e71228f-16bd-46c6-9666-fdea3a6da99e", "record_id": "flaws_cloudtrail:0000061:e71228f-16bd-46c6-9666-fdea3a6da99e", "row_index": 61, "timestamp": "2018-10-28T23:31:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1078, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e71228f-16bd-46c6-9666-fdea3a6da99e", "eventTime": "2018-10-28T23:31:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJIYW5kaEhBUlFPTi9UaHF2ZzQ3L0pockpjSFNJTjhXaXRiY2hxUjkwb0poa1I5MVpJaHZQRUJzNVdpRUR2T1dVTmZ1V002cit2SWsrV0dUc0RROE1QNDlzUHlUQ0xBWTFGd203Rm9TeW81Z3pVaGN5S3p4VWgrdXdxdjRWRmtoSE9zK3E2YjQyQ1l6Q0JybWFVWVYvK29VRkF1cXY5WmhnNGtpZFRkRS9RQ01rUnJkd0VScUd6SjBtRkNJT0RlREhqSEFlUEVnRUYwZ0tyZmFXL3YxL0FRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1e44a5bb-df6a-4bb8-a598-26241c0af", "record_id": "flaws_cloudtrail:0000062:1e44a5bb-df6a-4bb8-a598-26241c0af", "row_index": 62, "timestamp": "2018-10-28T23:31:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1076, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1e44a5bb-df6a-4bb8-a598-26241c0af", "eventTime": "2018-10-28T23:31:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIwRHNXSkYrbDhXZ1pha04yWStIc1V0Z09UUGVaRzVjM29obTNKb2xoUVo0SjNrbjdlQWRmUVJCQmw3WkpNRFUvM2dqM0dWSVJsbGtPRTJxc3Z1aTUvODRleHFlSStUNUlGZjRLV1B1NW93UUZhdGtYQTd6bGUvUk0vQmhhVDkrWHh5czArWk9xODFoazBGWkhNdEgyZHRUR0NDYStGUW85NmcyMmFLeDU0Y1NYSzZ6dWt5eEkzYlUxbzNabGdTMTBFa0Q3Q0lFUkFWQUhjQXdSVHQ4dGV3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "589709f0-a5e8-47b6-a2c3-4bd698c973d7", "record_id": "flaws_cloudtrail:0000063:589709f0-a5e8-47b6-a2c3-4bd698c973d7", "row_index": 63, "timestamp": "2018-10-28T23:33:56Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.250.69.253", "user_agent": "[aws-cli/1.16.4 Python/3.6.5 Linux/4.15.0-33-generic botocore/1.11.4]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 652, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "589709f0-a5e8-47b6-a2c3-4bd698c973d7", "eventTime": "2018-10-28T23:33:56Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.250.69.253", "userAgent": "[aws-cli/1.16.4 Python/3.6.5 Linux/4.15.0-33-generic botocore/1.11.4]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "266312c4-326d-4b6a-bac4-adadfd67b811", "record_id": "flaws_cloudtrail:0000064:266312c4-326d-4b6a-bac4-adadfd67b811", "row_index": 64, "timestamp": "2018-10-28T23:34:24Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 827, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "266312c4-326d-4b6a-bac4-adadfd67b811", "eventTime": "2018-10-28T23:34:24Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "volume-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "46fefdbb-f3e8-4b0d-be29-73264c30c", "record_id": "flaws_cloudtrail:0000065:46fefdbb-f3e8-4b0d-be29-73264c30c", "row_index": 65, "timestamp": "2018-10-28T23:35:07Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 760, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "46fefdbb-f3e8-4b0d-be29-73264c30c", "eventTime": "2018-10-28T23:35:07Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "attributeType": "CREATE_VOLUME_PERMISSION"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e7ea877e-4fff-413b-8241-2c3a5ceba1a8", "record_id": "flaws_cloudtrail:0000066:e7ea877e-4fff-413b-8241-2c3a5ceba1a8", "row_index": 66, "timestamp": "2018-10-28T23:38:00Z", "event_type": "DescribeInstances", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 692, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e7ea877e-4fff-413b-8241-2c3a5ceba1a8", "eventTime": "2018-10-28T23:38:00Z", "eventName": "DescribeInstances", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"instancesSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5bfd0ee7-f1f2-4203-9797-41db818400b7", "record_id": "flaws_cloudtrail:0000067:5bfd0ee7-f1f2-4203-9797-41db818400b7", "row_index": 67, "timestamp": "2018-10-28T23:41:33Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "[aws-cli/1.16.14 Python/3.6.5 Darwin/18.0.0 botocore/1.12.4]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 642, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5bfd0ee7-f1f2-4203-9797-41db818400b7", "eventTime": "2018-10-28T23:41:33Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "[aws-cli/1.16.14 Python/3.6.5 Darwin/18.0.0 botocore/1.12.4]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "70506ac4-b5b7-4a83-a748-10c620bc3141", "record_id": "flaws_cloudtrail:0000068:70506ac4-b5b7-4a83-a748-10c620bc3141", "row_index": 68, "timestamp": "2018-10-28T23:41:44Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.25.250.250", "user_agent": "[aws-cli/1.16.42 Python/2.7.14 Windows/10 botocore/1.12.32]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 640, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "70506ac4-b5b7-4a83-a748-10c620bc3141", "eventTime": "2018-10-28T23:41:44Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.25.250.250", "userAgent": "[aws-cli/1.16.42 Python/2.7.14 Windows/10 botocore/1.12.32]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d68b8ef6-5d6d-42cf-b3be-989578fb9a00", "record_id": "flaws_cloudtrail:0000069:d68b8ef6-5d6d-42cf-b3be-989578fb9a00", "row_index": 69, "timestamp": "2018-10-28T23:42:23Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.250.69.253", "user_agent": "[aws-cli/1.16.4 Python/3.6.5 Linux/4.15.0-33-generic botocore/1.11.4]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 652, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d68b8ef6-5d6d-42cf-b3be-989578fb9a00", "eventTime": "2018-10-28T23:42:23Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.250.69.253", "userAgent": "[aws-cli/1.16.4 Python/3.6.5 Linux/4.15.0-33-generic botocore/1.11.4]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "941492-b407-43c6-a9a3-46129ad302", "record_id": "flaws_cloudtrail:0000070:941492-b407-43c6-a9a3-46129ad302", "row_index": 70, "timestamp": "2018-10-28T23:44:59Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 807, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "941492-b407-43c6-a9a3-46129ad302", "eventTime": "2018-10-28T23:44:59Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "volume-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "747a748d-992c-426d-98a0-4c203518b100", "record_id": "flaws_cloudtrail:0000071:747a748d-992c-426d-98a0-4c203518b100", "row_index": 71, "timestamp": "2018-10-28T23:46:03Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "747a748d-992c-426d-98a0-4c203518b100", "eventTime": "2018-10-28T23:46:03Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "attributeType": "CREATE_VOLUME_PERMISSION"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3a632e9d-981e-472f-b37e-20747f8a845c", "record_id": "flaws_cloudtrail:0000072:3a632e9d-981e-472f-b37e-20747f8a845c", "row_index": 72, "timestamp": "2018-10-28T23:53:35Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "50.190.28.250", "user_agent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 911, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3a632e9d-981e-472f-b37e-20747f8a845c", "eventTime": "2018-10-28T23:53:35Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "50.190.28.250", "userAgent": "aws-cli/1.16.9 Python/2.7.9 Windows/8 botocore/1.11.9", "awsRegion": "us-west-2", "errorCode": "Client.InvalidParameterValue", "errorMessage": "The filter 'instance-id' is invalid", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "instance-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "268e6b54-2e76-43e8-b27d-b01e3a080f9e", "record_id": "flaws_cloudtrail:0000073:268e6b54-2e76-43e8-b27d-b01e3a080f9e", "row_index": 73, "timestamp": "2018-10-28T23:54:26Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "config.amazonaws.com", "user_agent": "config.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/config-role-us-west-2"], "raw_record_size_bytes": 1937, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "268e6b54-2e76-43e8-b27d-b01e3a080f9e", "eventTime": "2018-10-28T23:54:26Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "config.amazonaws.com", "userAgent": "config.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "config.amazonaws.com"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "roleSessionName": "AWSConfig"}, "responseElements": {"credentials": {"accessKeyId": "ASIAY6VXFSZQKNRED07S", "expiration": "Oct 29, 2018 12:54:26 AM", "sessionToken": "AgoGb3JpZ2luEKz//////////wEaCXVzLXdlc3QtMiKAAk94+Ux8mqP+rbVTK23dWWThCEt3SPe2DRuu5c4FeV1NLgIfNgiSLM45/zXtCenfBqjUc29re21WuuA2IldYHoqddKFmf2Eh+ZJEuzbS+pFL7ZiSVMEeEUbaJZnkKJBTWan072qKzv2Idh7YPSu8Sf2LfLCvyBEwW7BDRmagjGibFtsyxk2CSh9RTuyi5CRQbcsmF1HFK4HRulQ17h1+m+44T3sjCmk5jiP2DyUlYWk7yG7yiihFqL1jkJozFUiZngZW0Jxyq6p6/1Blf9xnvoeTUIFPsTSKTq7i7nNjaYSv8affh4r6NXOpA2vGS3e8A/7JrdyH6veTtMAHGko/dp0q6AIIIRAAGgw5NzU0MjYyNjIwMjkiDFx4tUvbbbrmHeuV4SrFAmYLawmg+gaysLSpVxIsyqt4E/3XvBL+u9ClXaEOzWjzFmPBH2H7EI5J4hmDEhBa0ni1EhCX+mnEce+U0XvkrMwPyjW/1d4BKjnd2BO03gDP8wfkJxvJMNC8mDUOkPfMQ05qf5oGqRG8NA6zaKlUGkF5F6M3beZZkKLq+jzQBfypPJGOAhY3v5py8vhxjPjXo7eRI1JNmbQXZ3kd36p9Z3r3FLp8AYwGiGSu3S+ikhDjuby+v4mLlHdBS4SaxxH9MnmyiOGjjwrwwRhGiqGTkpZY6nBXbMnBFZVd1MyzpZCqnaYV69Qa/CDWisalznN7IzTls4mosaasoLm9dLnGaWlbpx7rJT07sNV2nxNi9s3zRTkReC1Nvlrxast8hncNlPqvGdlXWIniohcBl+bIDf18hhRnjj0LU/o6XVXvfk4TNd9bi0kwspjZ3gU="}, "assumedRoleUser": {"assumedRoleId": "AROASM3HWKK95VDO4HH81:AWSConfig", "arn": "arn:aws:sts::811596193553:assumed-role/config-role-us-west-2/AWSConfig"}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/config-role-us-west-2", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "793660f19-cdde-490a-8770-0bab92e0a693", "record_id": "flaws_cloudtrail:0000074:793660f19-cdde-490a-8770-0bab92e0a693", "row_index": 74, "timestamp": "2018-10-28T23:56:51Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.250.69.253", "user_agent": "[aws-cli/1.16.4 Python/3.6.5 Linux/4.15.0-33-generic botocore/1.11.4]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 653, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "793660f19-cdde-490a-8770-0bab92e0a693", "eventTime": "2018-10-28T23:56:51Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.250.69.253", "userAgent": "[aws-cli/1.16.4 Python/3.6.5 Linux/4.15.0-33-generic botocore/1.11.4]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3d5d8add-4707-41e1-9009-5941b5e018f6", "record_id": "flaws_cloudtrail:0000075:3d5d8add-4707-41e1-9009-5941b5e018f6", "row_index": 75, "timestamp": "2018-10-29T00:09:08Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIA6SKY0OCKRQQ93AVY", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "6.31.247.139", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1029, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3d5d8add-4707-41e1-9009-5941b5e018f6", "eventTime": "2018-10-29T00:09:08Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "6.31.247.139", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIA6SKY0OCKRQQ93AVY", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-10-28T22:12:51Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logStreamName": "2018/10/29/[$LATEST]c00fccb70436f7e808537c109b130720", "logGroupName": "/aws/lambda/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3f6f879c-270a-4e1c-b23e-8e22184362f9", "record_id": "flaws_cloudtrail:0000076:3f6f879c-270a-4e1c-b23e-8e22184362f9", "row_index": 76, "timestamp": "2018-10-29T00:09:26Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3f6f879c-270a-4e1c-b23e-8e22184362f9", "eventTime": "2018-10-29T00:09:26Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c37473-0b26-4db2-9a3b-7366f05e404e", "record_id": "flaws_cloudtrail:0000077:c37473-0b26-4db2-9a3b-7366f05e404e", "row_index": 77, "timestamp": "2018-10-29T00:09:28Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c37473-0b26-4db2-9a3b-7366f05e404e", "eventTime": "2018-10-29T00:09:28Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "305b0585-168d-455d-b1a2-64b854ae82b0", "record_id": "flaws_cloudtrail:0000078:305b0585-168d-455d-b1a2-64b854ae82b0", "row_index": 78, "timestamp": "2018-10-29T00:09:41Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "305b0585-168d-455d-b1a2-64b854ae82b0", "eventTime": "2018-10-29T00:09:41Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c0e4b523-c950-4728-8581-824069cf7", "record_id": "flaws_cloudtrail:0000079:c0e4b523-c950-4728-8581-824069cf7", "row_index": 79, "timestamp": "2018-10-29T00:09:46Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 906, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c0e4b523-c950-4728-8581-824069cf7", "eventTime": "2018-10-29T00:09:46Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "263699dd-3ff7-4457-8dee-743ce74ac68f", "record_id": "flaws_cloudtrail:0000080:263699dd-3ff7-4457-8dee-743ce74ac68f", "row_index": 80, "timestamp": "2018-10-29T00:09:48Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "263699dd-3ff7-4457-8dee-743ce74ac68f", "eventTime": "2018-10-29T00:09:48Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "824c37b6-133a-4ee9-b1d6-9499ef0af22f", "record_id": "flaws_cloudtrail:0000081:824c37b6-133a-4ee9-b1d6-9499ef0af22f", "row_index": 81, "timestamp": "2018-10-29T00:09:49Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "824c37b6-133a-4ee9-b1d6-9499ef0af22f", "eventTime": "2018-10-29T00:09:49Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f0805d5d-ac05-4ff6-accf-c74d20b4426b", "record_id": "flaws_cloudtrail:0000082:f0805d5d-ac05-4ff6-accf-c74d20b4426b", "row_index": 82, "timestamp": "2018-10-29T00:09:49Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f0805d5d-ac05-4ff6-accf-c74d20b4426b", "eventTime": "2018-10-29T00:09:49Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be02351b-88f9-40ed-b136-d38e29803d", "record_id": "flaws_cloudtrail:0000083:be02351b-88f9-40ed-b136-d38e29803d", "row_index": 83, "timestamp": "2018-10-29T00:09:50Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be02351b-88f9-40ed-b136-d38e29803d", "eventTime": "2018-10-29T00:09:50Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c94d0551-3511-4e3b-8a2e-df5b60541051", "record_id": "flaws_cloudtrail:0000084:c94d0551-3511-4e3b-8a2e-df5b60541051", "row_index": 84, "timestamp": "2018-10-29T00:09:51Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c94d0551-3511-4e3b-8a2e-df5b60541051", "eventTime": "2018-10-29T00:09:51Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "22c58952-65e5-424b-8b8e-4af6ca0d353e", "record_id": "flaws_cloudtrail:0000085:22c58952-65e5-424b-8b8e-4af6ca0d353e", "row_index": 85, "timestamp": "2018-10-29T00:09:51Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "22c58952-65e5-424b-8b8e-4af6ca0d353e", "eventTime": "2018-10-29T00:09:51Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3e633aca-e941-4e7d-9c14-8885a23316", "record_id": "flaws_cloudtrail:0000086:3e633aca-e941-4e7d-9c14-8885a23316", "row_index": 86, "timestamp": "2018-10-29T00:09:52Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 906, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3e633aca-e941-4e7d-9c14-8885a23316", "eventTime": "2018-10-29T00:09:52Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8da32f08-1ef8-434f-9063-c38619a5539e", "record_id": "flaws_cloudtrail:0000087:8da32f08-1ef8-434f-9063-c38619a5539e", "row_index": 87, "timestamp": "2018-10-29T00:09:54Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8da32f08-1ef8-434f-9063-c38619a5539e", "eventTime": "2018-10-29T00:09:54Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b590f346-54f2-4011-a031-64aae4d5a1db", "record_id": "flaws_cloudtrail:0000088:b590f346-54f2-4011-a031-64aae4d5a1db", "row_index": 88, "timestamp": "2018-10-29T00:09:55Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b590f346-54f2-4011-a031-64aae4d5a1db", "eventTime": "2018-10-29T00:09:55Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fc1fd505-083e-4ef6-9ec1-ea385665b4f1", "record_id": "flaws_cloudtrail:0000089:fc1fd505-083e-4ef6-9ec1-ea385665b4f1", "row_index": 89, "timestamp": "2018-10-29T00:09:56Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fc1fd505-083e-4ef6-9ec1-ea385665b4f1", "eventTime": "2018-10-29T00:09:56Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f8e3b24c-a8b1-4254-90ad-569788eebbbf", "record_id": "flaws_cloudtrail:0000090:f8e3b24c-a8b1-4254-90ad-569788eebbbf", "row_index": 90, "timestamp": "2018-10-29T00:09:58Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f8e3b24c-a8b1-4254-90ad-569788eebbbf", "eventTime": "2018-10-29T00:09:58Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c206c465-692e-4c8c-a64f-fa9f63e6cdec", "record_id": "flaws_cloudtrail:0000091:c206c465-692e-4c8c-a64f-fa9f63e6cdec", "row_index": 91, "timestamp": "2018-10-29T00:09:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c206c465-692e-4c8c-a64f-fa9f63e6cdec", "eventTime": "2018-10-29T00:09:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "21367f71-0129-43fc-a074-f2664d8b0682", "record_id": "flaws_cloudtrail:0000092:21367f71-0129-43fc-a074-f2664d8b0682", "row_index": 92, "timestamp": "2018-10-29T00:10:00Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "21367f71-0129-43fc-a074-f2664d8b0682", "eventTime": "2018-10-29T00:10:00Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "41db388f-fdf7-43fc-b3b2-a874427e1a9e", "record_id": "flaws_cloudtrail:0000093:41db388f-fdf7-43fc-b3b2-a874427e1a9e", "row_index": 93, "timestamp": "2018-10-29T00:10:01Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "41db388f-fdf7-43fc-b3b2-a874427e1a9e", "eventTime": "2018-10-29T00:10:01Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "808c1632-3ce6-4e6b-b42b-b6fc1e4b2add", "record_id": "flaws_cloudtrail:0000094:808c1632-3ce6-4e6b-b42b-b6fc1e4b2add", "row_index": 94, "timestamp": "2018-10-29T00:10:01Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "808c1632-3ce6-4e6b-b42b-b6fc1e4b2add", "eventTime": "2018-10-29T00:10:01Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "96716a7-ea84-4917-924d-4a6cf3e8cad8", "record_id": "flaws_cloudtrail:0000095:96716a7-ea84-4917-924d-4a6cf3e8cad8", "row_index": 95, "timestamp": "2018-10-29T00:10:03Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "96716a7-ea84-4917-924d-4a6cf3e8cad8", "eventTime": "2018-10-29T00:10:03Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1a464ead-758d-4971-9806-14a8d59a612e", "record_id": "flaws_cloudtrail:0000096:1a464ead-758d-4971-9806-14a8d59a612e", "row_index": 96, "timestamp": "2018-10-29T00:10:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1a464ead-758d-4971-9806-14a8d59a612e", "eventTime": "2018-10-29T00:10:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c5188f1f-5b09-4b78-b353-72484d0fb0c", "record_id": "flaws_cloudtrail:0000097:c5188f1f-5b09-4b78-b353-72484d0fb0c", "row_index": 97, "timestamp": "2018-10-29T00:10:05Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c5188f1f-5b09-4b78-b353-72484d0fb0c", "eventTime": "2018-10-29T00:10:05Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c02cfe03-87c8-4745-afd2-9bc5d658fa5f", "record_id": "flaws_cloudtrail:0000098:c02cfe03-87c8-4745-afd2-9bc5d658fa5f", "row_index": 98, "timestamp": "2018-10-29T00:10:07Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c02cfe03-87c8-4745-afd2-9bc5d658fa5f", "eventTime": "2018-10-29T00:10:07Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f57938-3f0f-419b-a03c-055cf54fb12c", "record_id": "flaws_cloudtrail:0000099:f57938-3f0f-419b-a03c-055cf54fb12c", "row_index": 99, "timestamp": "2018-10-29T00:10:08Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f57938-3f0f-419b-a03c-055cf54fb12c", "eventTime": "2018-10-29T00:10:08Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3ced36c3-c19b-4ec8-9800-9aeae39e8c34", "record_id": "flaws_cloudtrail:0000100:3ced36c3-c19b-4ec8-9800-9aeae39e8c34", "row_index": 100, "timestamp": "2018-10-29T00:10:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3ced36c3-c19b-4ec8-9800-9aeae39e8c34", "eventTime": "2018-10-29T00:10:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0f8b7b93-0b76-4b9f-b517-4521f6e712673", "record_id": "flaws_cloudtrail:0000101:0f8b7b93-0b76-4b9f-b517-4521f6e712673", "row_index": 101, "timestamp": "2018-10-29T00:10:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0f8b7b93-0b76-4b9f-b517-4521f6e712673", "eventTime": "2018-10-29T00:10:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "781e90b0-e699-4356-946a-486b60748768", "record_id": "flaws_cloudtrail:0000102:781e90b0-e699-4356-946a-486b60748768", "row_index": 102, "timestamp": "2018-10-29T00:10:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "781e90b0-e699-4356-946a-486b60748768", "eventTime": "2018-10-29T00:10:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "53383cd0-bbc8-47fb-8644-3a9a354037e9", "record_id": "flaws_cloudtrail:0000103:53383cd0-bbc8-47fb-8644-3a9a354037e9", "row_index": 103, "timestamp": "2018-10-29T00:10:11Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "53383cd0-bbc8-47fb-8644-3a9a354037e9", "eventTime": "2018-10-29T00:10:11Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2131e2b3-767e-4a30-ae9a-3060c0f42baa", "record_id": "flaws_cloudtrail:0000104:2131e2b3-767e-4a30-ae9a-3060c0f42baa", "row_index": 104, "timestamp": "2018-10-29T00:10:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2131e2b3-767e-4a30-ae9a-3060c0f42baa", "eventTime": "2018-10-29T00:10:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7710c744-6357-4d46-85a7-19b05b09385c", "record_id": "flaws_cloudtrail:0000105:7710c744-6357-4d46-85a7-19b05b09385c", "row_index": 105, "timestamp": "2018-10-29T00:10:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7710c744-6357-4d46-85a7-19b05b09385c", "eventTime": "2018-10-29T00:10:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a9c60d5e-e967-4316-9bd4-6823e434e3f3", "record_id": "flaws_cloudtrail:0000106:a9c60d5e-e967-4316-9bd4-6823e434e3f3", "row_index": 106, "timestamp": "2018-10-29T00:10:14Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a9c60d5e-e967-4316-9bd4-6823e434e3f3", "eventTime": "2018-10-29T00:10:14Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "082d0730-7d81-4d06-85c0-bb5286d0f2fa", "record_id": "flaws_cloudtrail:0000107:082d0730-7d81-4d06-85c0-bb5286d0f2fa", "row_index": 107, "timestamp": "2018-10-29T00:10:15Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "082d0730-7d81-4d06-85c0-bb5286d0f2fa", "eventTime": "2018-10-29T00:10:15Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "974ceda8-44ef-481e-a5c2-0bed0978fcee", "record_id": "flaws_cloudtrail:0000108:974ceda8-44ef-481e-a5c2-0bed0978fcee", "row_index": 108, "timestamp": "2018-10-29T00:10:16Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "974ceda8-44ef-481e-a5c2-0bed0978fcee", "eventTime": "2018-10-29T00:10:16Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cf0731d5-d3dc-43b8-b2b6-54bc7b9fa011", "record_id": "flaws_cloudtrail:0000109:cf0731d5-d3dc-43b8-b2b6-54bc7b9fa011", "row_index": 109, "timestamp": "2018-10-29T00:10:17Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cf0731d5-d3dc-43b8-b2b6-54bc7b9fa011", "eventTime": "2018-10-29T00:10:17Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e3e47e3d-3128-4572-b6f3-9dc3241acbca", "record_id": "flaws_cloudtrail:0000110:e3e47e3d-3128-4572-b6f3-9dc3241acbca", "row_index": 110, "timestamp": "2018-10-29T00:10:19Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e3e47e3d-3128-4572-b6f3-9dc3241acbca", "eventTime": "2018-10-29T00:10:19Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7914ccce-ef6f-4075-8e18-924a223358ca5", "record_id": "flaws_cloudtrail:0000111:7914ccce-ef6f-4075-8e18-924a223358ca5", "row_index": 111, "timestamp": "2018-10-29T00:10:21Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 911, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7914ccce-ef6f-4075-8e18-924a223358ca5", "eventTime": "2018-10-29T00:10:21Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b6d13286-d1c1-4d8f-ab08-a65958a3a69b", "record_id": "flaws_cloudtrail:0000112:b6d13286-d1c1-4d8f-ab08-a65958a3a69b", "row_index": 112, "timestamp": "2018-10-29T00:10:21Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b6d13286-d1c1-4d8f-ab08-a65958a3a69b", "eventTime": "2018-10-29T00:10:21Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3dc6c244-c139-4f05-a83d-1b57da964ed1", "record_id": "flaws_cloudtrail:0000113:3dc6c244-c139-4f05-a83d-1b57da964ed1", "row_index": 113, "timestamp": "2018-10-29T00:10:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3dc6c244-c139-4f05-a83d-1b57da964ed1", "eventTime": "2018-10-29T00:10:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8985e1ee-e09e-405c-9745-4d1f090385d07", "record_id": "flaws_cloudtrail:0000114:8985e1ee-e09e-405c-9745-4d1f090385d07", "row_index": 114, "timestamp": "2018-10-29T00:10:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1484, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8985e1ee-e09e-405c-9745-4d1f090385d07", "eventTime": "2018-10-29T00:10:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA7YZ07CWSHHA865LG", "expiration": "Oct 29, 2018 6:46:23 AM", "sessionToken": "FQoGZXIvYXdzEGoaDP9iCofopRpHvBmpwiK3A0bA0tzyis9yjZDp7lKulTtptlykTEKJZlkUSmYJ9bHaM8ddDDi4W3gri0BE50yJ5bRnm+ydE0C+M/SRzI5aljB6tjCSg/mIfBpaFlqHY0clYex5OJZIIEGvAZsshxFXGt5SdBklV/TjFwDiCN7R6oyyCwBIJr1t/Po3Bi5WYqWzo8Qhz1Y5Il5w2wa+EkswfOvw43GRRgDYXZa6iA6H8xXbt4DmnFE66JJt1W3hZb0kSjJrGA0xTS9ONZAEaKq3KKv4WNiFSsOPch98KT8e1hCuqiwD1GTcsdQ4tpYwd3/wn6wT4c3g3ycHKLupr9u00mSbqKjYGjxsIW5l2zMq0tCD63noWDxGCyM7/iGTUdvBpxpAopH0rwFGhZeuEBQEsFy2iHkYDO0IO33CvRiLEylo4noOGK2LCbw/xxFYe7Uoiv0gozOXrpOkiSXIu3/fHoJbFNdIZp4G6Fz85RONGNPFEZXDwQbVpkCY2swKdc+DapXc0avA5dzGYc9aMiUGP/DUFUWbGXZfF2GgPjqzkPw8bR4gIIRrXdRviZMT8+s35zrkjVjy0nmCd2hxsZGuL0tOufS1iz0ok6DZ3gU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2a256e12-1da6-4145-9005-9e54d867870a6", "record_id": "flaws_cloudtrail:0000115:2a256e12-1da6-4145-9005-9e54d867870a6", "row_index": 115, "timestamp": "2018-10-29T00:13:22Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.250.69.253", "user_agent": "[aws-cli/1.16.4 Python/3.6.5 Linux/4.15.0-33-generic botocore/1.11.4]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 652, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2a256e12-1da6-4145-9005-9e54d867870a6", "eventTime": "2018-10-29T00:13:22Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.250.69.253", "userAgent": "[aws-cli/1.16.4 Python/3.6.5 Linux/4.15.0-33-generic botocore/1.11.4]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "86b384b1-87aa-4f6e-bdd2-f6d7a398b145", "record_id": "flaws_cloudtrail:0000116:86b384b1-87aa-4f6e-bdd2-f6d7a398b145", "row_index": 116, "timestamp": "2018-10-29T00:15:41Z", "event_type": "ListUsers", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.250.69.253", "user_agent": "aws-cli/1.16.4 Python/3.6.5 Linux/4.15.0-33-generic botocore/1.11.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 669, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "86b384b1-87aa-4f6e-bdd2-f6d7a398b145", "eventTime": "2018-10-29T00:15:41Z", "eventName": "ListUsers", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.250.69.253", "userAgent": "aws-cli/1.16.4 Python/3.6.5 Linux/4.15.0-33-generic botocore/1.11.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "41f289b0-56e1-4021-ab7d-adafa4a2f455", "record_id": "flaws_cloudtrail:0000117:41f289b0-56e1-4021-ab7d-adafa4a2f455", "row_index": 117, "timestamp": "2018-10-29T00:16:40Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.250.69.253", "user_agent": "aws-cli/1.16.4 Python/3.6.5 Linux/4.15.0-33-generic botocore/1.11.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "41f289b0-56e1-4021-ab7d-adafa4a2f455", "eventTime": "2018-10-29T00:16:40Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.250.69.253", "userAgent": "aws-cli/1.16.4 Python/3.6.5 Linux/4.15.0-33-generic botocore/1.11.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fd8c96d7-5be6-4450-a9c8-30ae4f88b546", "record_id": "flaws_cloudtrail:0000118:fd8c96d7-5be6-4450-a9c8-30ae4f88b546", "row_index": 118, "timestamp": "2018-10-29T00:18:06Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.250.69.253", "user_agent": "aws-cli/1.16.4 Python/3.6.5 Linux/4.15.0-33-generic botocore/1.11.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 730, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fd8c96d7-5be6-4450-a9c8-30ae4f88b546", "eventTime": "2018-10-29T00:18:06Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.250.69.253", "userAgent": "aws-cli/1.16.4 Python/3.6.5 Linux/4.15.0-33-generic botocore/1.11.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "597d3113-bb71-4d3a-bce6-a6b4c3afafe3", "record_id": "flaws_cloudtrail:0000119:597d3113-bb71-4d3a-bce6-a6b4c3afafe3", "row_index": 119, "timestamp": "2018-10-29T00:18:41Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "255.250.69.253", "user_agent": "aws-cli/1.16.4 Python/3.6.5 Linux/4.15.0-33-generic botocore/1.11.4", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 754, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "597d3113-bb71-4d3a-bce6-a6b4c3afafe3", "eventTime": "2018-10-29T00:18:41Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "255.250.69.253", "userAgent": "aws-cli/1.16.4 Python/3.6.5 Linux/4.15.0-33-generic botocore/1.11.4", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "08122dae-0afd-4c34-a11a-fc899bdc323a", "record_id": "flaws_cloudtrail:0000120:08122dae-0afd-4c34-a11a-fc899bdc323a", "row_index": 120, "timestamp": "2018-10-29T00:19:36Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1219, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "08122dae-0afd-4c34-a11a-fc899bdc323a", "eventTime": "2018-10-29T00:19:36Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIA5O6EOMAFTD7BRPO1", "expiration": "Oct 29, 2018 12:19:36 PM", "sessionToken": "FQoGZXIvYXdzEGoaDCDKT/wBtDd1x6mFhiLfAc1kpZW25jOwn67xoOpwI/dLwV67+jiJ+SEmERp8XckJhDFtA1ndjjUYVwKjT9ZSxe7mMFPtZA5CaDDWmxL++VGwX9FSvUNsrSbjchpR8XCOMGVAAnV3LhbH2SxN3qFKvwzK9WQnV2V7IMBu6x5FhsoT/5/CT+FNrck/CbdbT8x1aoZEiFeanrm6f7918b8pE4m+noKWcpGyNVTRsMixyZWKebRhxVBU6DNuvletSRnel6a73OKhci6MtWWOGu6/AGyNQTq0Z18rnvU1Zqc88wujov4MUqSnWwcbOV3SvtgomKTZ3gU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "becb4eb6-6353-49ef-b14f-5d69f3393e92", "record_id": "flaws_cloudtrail:0000121:becb4eb6-6353-49ef-b14f-5d69f3393e92", "row_index": 121, "timestamp": "2018-10-29T00:21:52Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "[aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 637, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "becb4eb6-6353-49ef-b14f-5d69f3393e92", "eventTime": "2018-10-29T00:21:52Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "[aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "01a66699-b7cb-4091-bfc1-0bb253e74a21", "record_id": "flaws_cloudtrail:0000122:01a66699-b7cb-4091-bfc1-0bb253e74a21", "row_index": 122, "timestamp": "2018-10-29T00:23:27Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "[aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 641, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "01a66699-b7cb-4091-bfc1-0bb253e74a21", "eventTime": "2018-10-29T00:23:27Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "[aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8627bbb8-16f8-4f47-b613-5b1647bfc86f", "record_id": "flaws_cloudtrail:0000123:8627bbb8-16f8-4f47-b613-5b1647bfc86f", "row_index": 123, "timestamp": "2018-10-29T00:34:40Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 766, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8627bbb8-16f8-4f47-b613-5b1647bfc86f", "eventTime": "2018-10-29T00:34:40Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bbed3106-663b-44f2-9fc0-158050d7d821", "record_id": "flaws_cloudtrail:0000124:bbed3106-663b-44f2-9fc0-158050d7d821", "row_index": 124, "timestamp": "2018-10-29T00:35:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bbed3106-663b-44f2-9fc0-158050d7d821", "eventTime": "2018-10-29T00:35:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c9d5311-bc54-4292-b3b5-2d5bd9ff50e2", "record_id": "flaws_cloudtrail:0000125:8c9d5311-bc54-4292-b3b5-2d5bd9ff50e2", "row_index": 125, "timestamp": "2018-10-29T00:36:24Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 748, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c9d5311-bc54-4292-b3b5-2d5bd9ff50e2", "eventTime": "2018-10-29T00:36:24Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2fdedb08-4e97-4d67-8645-a4937ff8bd77", "record_id": "flaws_cloudtrail:0000126:2fdedb08-4e97-4d67-8645-a4937ff8bd77", "row_index": 126, "timestamp": "2018-10-29T00:36:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2fdedb08-4e97-4d67-8645-a4937ff8bd77", "eventTime": "2018-10-29T00:36:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJISHFqeTIvNm40MnA2TmNxcHpxenh0MGlXSUsxSjBONTJjZ2NJUlZ3RHcyb2NWd0c5Zkl1SXdSR0R4ZFYwd3VlS29SMzNyVnNBNXlLV2xCcXlkN0ZmUzFkTnJ6NU55OU9JdFM4aGUzR1FTM014czQycXM4RnRXMzZubzVTSU5wQ1lTem5WMlBsWXFxV1dRSTRGN3NUSFgrY1hCcjZwOWUwR3ZqRWxsNDRtL1Y3TmxyTUNtdm4wTkRwa0oxQkdWQU5rQThqIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "19b3612f-6c11-4e6c-b89f-f55085a4fe33", "record_id": "flaws_cloudtrail:0000127:19b3612f-6c11-4e6c-b89f-f55085a4fe33", "row_index": 127, "timestamp": "2018-10-29T00:36:26Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "19b3612f-6c11-4e6c-b89f-f55085a4fe33", "eventTime": "2018-10-29T00:36:26Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJQeDB5aVJ1VTEvWkQwQ2xrdzRhVi93LzJUd1RIblI0NEVQNEs4Z1lxWllyRXNWWXdyYjV3a0tsK0tBWVNVOFdTZmxWMkpOMkJjdnpSU2lvZVdGUk5IbGJXd0ZKaWY1VHJ4TmJ2ZkJoVXNaUURoYWZPYmsyNVpXL1UyRkVqcmFrN211VVZDM1JRT013UVhQbnNKUm04OHlScDk2NzFVUEx1aVhndENueGVNUGcrKzZVTlk4OVYyUzM1ckdqOVJ1OFc5U0RjIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ee3e5ad7-f7e8-40f9-b653-863a7616d98e", "record_id": "flaws_cloudtrail:0000128:ee3e5ad7-f7e8-40f9-b653-863a7616d98e", "row_index": 128, "timestamp": "2018-10-29T00:36:28Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ee3e5ad7-f7e8-40f9-b653-863a7616d98e", "eventTime": "2018-10-29T00:36:28Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI3bm9OeCtCZFhzSVp6MXdycG5wSXBiaEJMRTZvTk5SY3NaKzJoYjF4ZHRVcU1yWVkxUUcrSExISHdRclo3THg4SUxWR1JOV0M2ejVmQm4wV21pdDRoazZLK0lYaHQwNVIvUWF4LzVadURhc0JtMGxWbGRJTUpzV3F1NFY0MW5iOEVUY0oyWHJrc1owbFhkUy9MOHN2T2RBNEUvNEpNSkZiTTVkOFpLakFIb2VsU2gyQXQ1N3pSUE1nSlJRZFBiQnYwMXdhIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "edcdc4c9-1951-4afa-8fdb-43872fa7c68b", "record_id": "flaws_cloudtrail:0000129:edcdc4c9-1951-4afa-8fdb-43872fa7c68b", "row_index": 129, "timestamp": "2018-10-29T00:36:29Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1057, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "edcdc4c9-1951-4afa-8fdb-43872fa7c68b", "eventTime": "2018-10-29T00:36:29Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIvUG55b2JTQ04zZDFyRURsWjRycDk1bmFiaXlIK3JYZFRBK1lDR0cxSGViOTJPUXBSR0xvZElBSkp3YWxTbE8yaU13MEU0emthcXFRU2NSQ1ZlNzJ5YlhWVjh2SXNINGNwWkhGYk55ZEtTVGtBL04wL2RtRHc0OVZDcGk0cTVHV0JQSzFWNHpVMlZNbGFvUDJ0OXNTTGl6UkhyblJjaEtqM1hqTDVXQ1VkWVYxVmNTRys2UFRNeHA0V0JYNHpnRHI2dnlqIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1c4d5719-b07e-44d6-9048-380963c24a5c", "record_id": "flaws_cloudtrail:0000130:1c4d5719-b07e-44d6-9048-380963c24a5c", "row_index": 130, "timestamp": "2018-10-29T00:36:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1c4d5719-b07e-44d6-9048-380963c24a5c", "eventTime": "2018-10-29T00:36:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJGeFhnQW5mbmRQQmpBbGdLV1E2ZDE2cVBkcHFoSFBsSDlEei90RmxwQ1hOOUpEdWR2WnNSRlFWMHhOb0QwZ2UvakJwQW9uTmdoV1lscFU3ZWRlQkJaTlFhMHYxVXpkSkFQeFdRbzA4UFVsQVA2c2ZkOTRuK0k1TWNqZWhSVEY4YWdWVURXYWNvc3RGdE41WTZ3azRPajRhU3d1S0l1Q3dkQWIwZlBIcnRtSC9kM2pCSnpIcUt2UXJhQTg4T3lWRFEyRTRVIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "442dd719-986d-4460-af22-3a7d3dcb73e4", "record_id": "flaws_cloudtrail:0000131:442dd719-986d-4460-af22-3a7d3dcb73e4", "row_index": 131, "timestamp": "2018-10-29T00:36:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "442dd719-986d-4460-af22-3a7d3dcb73e4", "eventTime": "2018-10-29T00:36:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJOY3NJSXM3bVRBM1Q0SHY5NTJFdnd2K1lSK2hrdWQ5MFlCUTZlWnJpNkpldEpneVJtUXFJY3hRVTNEZGRTUWZFRWNvSGpPVDQrWHlrS2k2T2JCTGxRbVBldmo1aWlXRXVFckRYeG5ZdmtxZzVhMXBSQ3QzVlZxNUVrVXZSWDN3YkZuZ3RzRmRHdkUxZkF6dDkrRUFpeEtQMjdUM0tpRy9YMm0zMTVTV0E0R3RlcVBPWFI2UmhkSXZSRHJQM0NwZHE2R1dZIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "91325a-25c8-43ed-b205-d35fb80ddabc", "record_id": "flaws_cloudtrail:0000132:91325a-25c8-43ed-b205-d35fb80ddabc", "row_index": 132, "timestamp": "2018-10-29T00:36:32Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1057, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "91325a-25c8-43ed-b205-d35fb80ddabc", "eventTime": "2018-10-29T00:36:32Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIvUERJa1Nsb25MZnNtV3FFengwSEdwWVF5eGcrY1BmeStTMmIweVdSS2JjaDAvTVVuK2RjQzVmZFVIdDdVVy82d0lQZndqNHR4SElBRW9USmVzejdKRUQ0YVlwZVdtNStWYWNIZlVOU2RaZnpYMVh3NzVZbEhJRFIxOUtyRXRBYVUwU21naDcyK2x2YTU3aTY4dUN4WjEzZk9yN1F2NzJZRzdzTkFnTENFWGZLdnRSakIrQXNnbmRKZi9xSmFXcG1CdFJqIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2aea332c-d4aa-486a-9c59-a68902accee7", "record_id": "flaws_cloudtrail:0000133:2aea332c-d4aa-486a-9c59-a68902accee7", "row_index": 133, "timestamp": "2018-10-29T00:36:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2aea332c-d4aa-486a-9c59-a68902accee7", "eventTime": "2018-10-29T00:36:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJWR1N2d3BxUGZLZmFrYnhycm00dlo5QjNHZEFGZW1JSS9IZHVvSklZa2x5T0lmWFErbzVvblZsMTV3NGlDdEtJblJsUHJldUhzNFRYMkpjTVYrcDVBejZhRUtUOU1tYTZiaEtFaHk0dnlxRk5nSzdDTnlsbGpjYnRHZElMUXQ1aElJWlVnL0hPUTZyQnUwSWptdnZsRCtFZE95Z0dxblgwWHd2NE9OdWRRbTlNRG9PdHBQR1E3Z3RMNVNMb2thMGFDWUxIIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b374ae3e-37d2-4ce0-80e3-9d926c31da87", "record_id": "flaws_cloudtrail:0000134:b374ae3e-37d2-4ce0-80e3-9d926c31da87", "row_index": 134, "timestamp": "2018-10-29T00:36:35Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b374ae3e-37d2-4ce0-80e3-9d926c31da87", "eventTime": "2018-10-29T00:36:35Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4RWRPUWVwVk5CVWFVbjltN2wxcm5TWXNYKzZ4Tnd5QXQyM2drRndMUzQyVHlqaFl5RmM1RTlEQXJNa1UxK1V5K2FNVXNEMFZRYTBrVzNia3pzb1FtbVFoUzhFUkNjMTFqVzk4eTJSNUhQNmhuMXhsWjdyUTlYL2t0RnYxMk1FT3cxbUtGczRhS20vZDV6Z1Q5M1dWQ0F3cld4YVFxZUs1LzZnVjJnaFEwejRjYXNIcVdxdXplYVc0czU4RG0vVThwdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "04133f-b3e1-4a3a-ab9d-a5f1a55d09ae", "record_id": "flaws_cloudtrail:0000135:04133f-b3e1-4a3a-ab9d-a5f1a55d09ae", "row_index": 135, "timestamp": "2018-10-29T00:36:37Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1057, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "04133f-b3e1-4a3a-ab9d-a5f1a55d09ae", "eventTime": "2018-10-29T00:36:37Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJIZzk5U2ZkWDdxRU9BanZuQy83KzdKWEw4UzBwNVJEK0JwYXRqWHF3bmR5LzNlWnVQRE1HeTFpaU9WNEplaXRaTUhvYVZtQUJWckkvSWxMazFRa25JRnpiSnY1RWMzU3ZrcytRai9sRlIwM2RzUWhvS1lpL0s1RGdMazVsU2VNaC9hUGdvUDgyc0l4eVF5UVdHTHpwWDQxU25Rdm1IZFNaMDRldHNnZUNxZXluK2M2a1E1RWFxVjJlK1dUYmczc2c1TXBSIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bcec5d36-5f2c-41e8-95e7-ce08afab5467", "record_id": "flaws_cloudtrail:0000136:bcec5d36-5f2c-41e8-95e7-ce08afab5467", "row_index": 136, "timestamp": "2018-10-29T00:36:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bcec5d36-5f2c-41e8-95e7-ce08afab5467", "eventTime": "2018-10-29T00:36:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJJb1c2RW9HRjIrNVlzR1hGdkIvRVpBSndPNGN6bi93czFjTElTUFVpcTZncUhyMDdsUG5PNXJEa2Rra2tPY1Y3b3BKU1RMcm1aVUhCODNMSzJjcEYweldpN01DWlpyRUhNSWJtWVJrUjhrb0hvZFY0cXpLK3dPZ2dmVkIvSEZndHBlS0c5aktwZWZjQnlWcDRCUVZNUElXUXNoS2xxVC9uK3Nwdkh1S2pKU1N4alFFUXRMV0ZGRVJhZ2IxUy8xcmJkR2dRIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4b0de59d-6d2c-4d49-8160-d027522d3ef", "record_id": "flaws_cloudtrail:0000137:4b0de59d-6d2c-4d49-8160-d027522d3ef", "row_index": 137, "timestamp": "2018-10-29T00:36:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1058, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4b0de59d-6d2c-4d49-8160-d027522d3ef", "eventTime": "2018-10-29T00:36:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIwTnZ5b2JwYWEzZ2tFdmwralpRdi84bkJxOFN6U1ZCYk9uUjhJSGs0bURXOTZETXRuTCtMb1NxWlZReitTbnVaOENLOUhRdWxTMER2VHpUcjQ0R3ZuN1YxcWpKckpxbUpTdXZ3R0dBWVpEbGVwZlFoR2M1cFBCcnljMnZRU3pKOG4vNlhyQndLdktuQ0UzamRkRUJxTUdzM3h0Ykk3b0NFeUJsb09ZVExnTmtQeTJsY2d3VDMyOFVDY0NYUkxSVkR3TGd2IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "caa1b9bf-c96b-4740-92a2-cb1e5d4b9081", "record_id": "flaws_cloudtrail:0000138:caa1b9bf-c96b-4740-92a2-cb1e5d4b9081", "row_index": 138, "timestamp": "2018-10-29T00:36:41Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "caa1b9bf-c96b-4740-92a2-cb1e5d4b9081", "eventTime": "2018-10-29T00:36:41Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJpd3pMTFVnNStNZWQrcTdHTXhHcEV6WlJpTm5LVmdKRDdiZm5WVkh5Y2w1dmwwSmMrMW91TmdjSm9qU0dYTnBEdFBpcXBVNjB3Nnd0bnZuVHRmU1BrSlRGaGlUNGtGbVQxT0RmTTFPVDRaTXJta3RxcnB0Y2RJcnlDZkhuK3JDMW4rMTdyUEV6b0JDYUxaSFUzSUVTcytQdzU3aVlMUWI3TXZ0ZDdlcE5FNkdiaFV6dG1udFRUSkJDWGdrU3lVZ0VKckxZIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4832fbba-bc32-4c72-818d-7c9f1fcd475a", "record_id": "flaws_cloudtrail:0000139:4832fbba-bc32-4c72-818d-7c9f1fcd475a", "row_index": 139, "timestamp": "2018-10-29T00:36:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4832fbba-bc32-4c72-818d-7c9f1fcd475a", "eventTime": "2018-10-29T00:36:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJuQnlIeWRWbEF6aG9pSE1tRWZkWXNCTVVwc01WVEdjWk5MYWtSc0pBdFYxME05eXFyNkdUck43WWRKZm02R3l4Tlo2SDdPT3ZLLzQxNXFBaDhuSncycnJqR1pEU3p4WUNJVWRLWXc3QU5NaVRsb0tycjdmTVhYbENNTzlXUDJqSjFaeE8xZ0dBQlZ3dm1IV3BUVis4RTdJbEFSRVgycHpqdjdlNGswQzNZTlI4ZmtCbDMvcW1MK0JEaHRSdDMwUUdlL0ljNTA0enBLdStBdGM2SUlzUUFBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d88ae684-2d7b-43f3-8904-bd2157fb5d4a", "record_id": "flaws_cloudtrail:0000140:d88ae684-2d7b-43f3-8904-bd2157fb5d4a", "row_index": 140, "timestamp": "2018-10-29T00:36:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1051, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d88ae684-2d7b-43f3-8904-bd2157fb5d4a", "eventTime": "2018-10-29T00:36:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJkcWt2T29mTnI4MnRLSEZwd2JScXJwWldKeGpOV0xXb3BmU3RqUytHV3UzRDIyWitFT1ZBemx0RThudGpTOXZKYUx1S3c3bXUwWk9oekRoQXA0eGFpTHVkT1p6aktaaXhwQkJWdG9JVGV4NW1ZZy90OG9Dbk1RMWlpV1U4Rk5rWmgrbExrM0RRUy80dVV5Q1pyRkIyYkVOaVU5VnJUWHVPWC9lUjBNR0JaZzA2d3c0c1NES1YvMkxFaEhvYWpTYnMiLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f68b14e3-00df-4982-864a-b60031a7a07c", "record_id": "flaws_cloudtrail:0000141:f68b14e3-00df-4982-864a-b60031a7a07c", "row_index": 141, "timestamp": "2018-10-29T00:36:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f68b14e3-00df-4982-864a-b60031a7a07c", "eventTime": "2018-10-29T00:36:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI3d2NoRmZQbG1iNWhqazU2bVRJR3c5TlBLdEFDZVZuSzdCblE2MXprRmlMREk2Y0Fwc29ON05qTFhmclcrZ3U5alZSeW1JWVU1WFYyd2ZsdWx0cXJCd3Bub1E1Q2hLMTNHSkFSaEdEUmZvVkJzNTdMNEl1aVVrSHh0S242SGRmSy9kcnQ0WlBROHJVdTNtRitySFBBOVdBaHYyaVJUUmZNb2x0c01DUVh3a2huTHIvTW9ZK0loVjNkeDBoczVnK3VVbnlPbE00dzhjYStGUkhoMkNydmpnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a4ac8a2a-9678-4268-b64d-d70213cd3e8c", "record_id": "flaws_cloudtrail:0000142:a4ac8a2a-9678-4268-b64d-d70213cd3e8c", "row_index": 142, "timestamp": "2018-10-29T00:36:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a4ac8a2a-9678-4268-b64d-d70213cd3e8c", "eventTime": "2018-10-29T00:36:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJUMlVkZ0hES3N2MUpSbFJtYy9iRExUcDJXSy81WktUaU9iU3QrcW1MTW9qb2tNRm1mUXBKMG9TMnZwL1RTNjFjZ2J4ZjZDSVVPYkNySUZsRUlXaStjOElKUEdoazl5ZWVlMEtpVW1jWkxSVkRML2x6dEVkNGdVODQ5bU1LZ3ZGUDBhbjQxbUIzdWhuZkVFSFNwSW1tMUVrQ0dwL2k4cFdsUHBtVlNYdWk3akU0TC9sSnhkWW5vV21DZUx1c2FoTzlSOWxCYmtaeHNIWXljNVBXMW13bmlnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b5ff8826-9f09-457c-bed4-7bbbeae1b2c9", "record_id": "flaws_cloudtrail:0000143:b5ff8826-9f09-457c-bed4-7bbbeae1b2c9", "row_index": 143, "timestamp": "2018-10-29T00:36:42Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b5ff8826-9f09-457c-bed4-7bbbeae1b2c9", "eventTime": "2018-10-29T00:36:42Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJHMmxDUy84eGFlOFFrbUx4enJjenZKL1E4Wmw0RjFoRld5UXYzb05BaVcrYkJmVitaNnc2OTZVanpXRXJvK213ZDh6ODVldnF5MGtPVml6UjVSVVkvalZjNm1ZbE9aMGdUUnJMOXl0YmpZVFZzTlFETUZVWXBaZ09KbWVpTm1TbEtMdGpVZno0S2tWSGlMTE0zc2gvSm9mOXVVSXNWY3VkS3VTK08ybEZySDR6aU11MEpjU2l2SmF1QUUwVnAvdGIxQkp1b1N3ak1UK256U292K3Nhd3NRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2234aea4-532b-4a31-9418-c9e9d58c9b1a", "record_id": "flaws_cloudtrail:0000144:2234aea4-532b-4a31-9418-c9e9d58c9b1a", "row_index": 144, "timestamp": "2018-10-29T00:36:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2234aea4-532b-4a31-9418-c9e9d58c9b1a", "eventTime": "2018-10-29T00:36:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ4OUV2ODFBNW0rSWtKWi8xNUwxeTNHNjBJSEJRamhPM1BJZHhuSGVrRFlCNENTNkRKV2RiTXhXS1dnL2FsUWpTUkVRYndoVnVjTG83U0pmWlh0TXNwcHdTZjlXZUtnVzlIZTBTdDY2cUlNcllBRVByWWtiRTVDQ1owLzVweit0WGhwL2xuY2RaRjBFc2dyZi9Id0x1dmJka0FZS0RlUTVrUVRZbWlMdjJmWUE5L0x0cWJLYjlMbTVObEgxQ2VqTEd4RUoweU9IeHp6QXgydXo5TG9sbkFRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e2940ca4-7853-4495-8004-d108bf91130f", "record_id": "flaws_cloudtrail:0000145:e2940ca4-7853-4495-8004-d108bf91130f", "row_index": 145, "timestamp": "2018-10-29T00:38:41Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.1.107.251", "user_agent": "[aws-cli/1.16.43 Python/3.7.0 Windows/10 botocore/1.12.33]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 634, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e2940ca4-7853-4495-8004-d108bf91130f", "eventTime": "2018-10-29T00:38:41Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.1.107.251", "userAgent": "[aws-cli/1.16.43 Python/3.7.0 Windows/10 botocore/1.12.33]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6727bb1c-01f4-44cd-bd4e-9a286540777b", "record_id": "flaws_cloudtrail:0000146:6727bb1c-01f4-44cd-bd4e-9a286540777b", "row_index": 146, "timestamp": "2018-10-29T00:39:05Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "216.252.5.229", "user_agent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 782, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6727bb1c-01f4-44cd-bd4e-9a286540777b", "eventTime": "2018-10-29T00:39:05Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "216.252.5.229", "userAgent": "aws-cli/1.16.6 Python/3.7.0 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4471a047-6715-47b7-beb6-94111ab3c53a", "record_id": "flaws_cloudtrail:0000147:4471a047-6715-47b7-beb6-94111ab3c53a", "row_index": 147, "timestamp": "2018-10-29T00:46:02Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.1.107.251", "user_agent": "aws-cli/1.16.43 Python/3.7.0 Windows/10 botocore/1.12.33", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 764, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4471a047-6715-47b7-beb6-94111ab3c53a", "eventTime": "2018-10-29T00:46:02Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.1.107.251", "userAgent": "aws-cli/1.16.43 Python/3.7.0 Windows/10 botocore/1.12.33", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "920480-4d95-4b71-a9f0-5f68b3259b00", "record_id": "flaws_cloudtrail:0000148:920480-4d95-4b71-a9f0-5f68b3259b00", "row_index": 148, "timestamp": "2018-10-29T00:46:20Z", "event_type": "CreateVolume", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1509, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "920480-4d95-4b71-a9f0-5f68b3259b00", "eventTime": "2018-10-29T00:46:20Z", "eventName": "CreateVolume", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: Am5-WxgANdM1hdr2SN39wRsZPEXgDTrxondathra9Opf7LcupJsd-GawDw3xJGnSfZy7ufdH8HnM1D39-_jkoI3Cdh5n4MLn9JUiCZcwus8LzAj7CQbwmZMKcekQrbTVWfzfZpx-0Uhj4e2gzQyNqn0nkGXtZoRGSlHvfMu8W-XOBNnwXR-BzyGC4PuoSb5uGjRxRydstEGSbYCB0Yqd7WXKECWMsXSBA8IjETd2wvk5ma70AeA-zvJF3GPRL6m8oYaCawOI1yJtbdzIKGJtIh7jR51JvVxgZpvhEvfn5CPpARb2eNeBX5CpRO1Y71B0jnIKKAkniQy87eDKpwVU8kZ0Z1xFOi1OFU2YNgOIKOM0I_Q0lLvPBgHQBR08ejccbUDR-ljp2dF8FA8q79Az6rG-q1G9JydE4d3hC290YyvLFM8tGssMyWRhBFbGc6p4ZZ2gw72V-ccIAusAv6hK3ZIWskQXofF6P7zQd-0QWsHBZrjbMDkHihbENgSHjE-14Em1gNsinuBQ8QDUYQsyFY013krDOT3bVQCnBifhSspsC92cZBmhOpkpKJbIHViq60ScvB4znUt5XMbo48EtTaO7hSw5DlpSYEdj-Gat21KeT_pMHaZrGn4Jof3RCQ", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "zone": "us-west-2a"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a33cedec-767e-48ae-95a0-01154b5407ba", "record_id": "flaws_cloudtrail:0000149:a33cedec-767e-48ae-95a0-01154b5407ba", "row_index": 149, "timestamp": "2018-10-29T00:46:49Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "5.1.107.251", "user_agent": "aws-cli/1.16.43 Python/3.7.0 Windows/10 botocore/1.12.33", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 779, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a33cedec-767e-48ae-95a0-01154b5407ba", "eventTime": "2018-10-29T00:46:49Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "5.1.107.251", "userAgent": "aws-cli/1.16.43 Python/3.7.0 Windows/10 botocore/1.12.33", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "608f569b-9fd0-4759-bb3b-43adf3c92a8e", "record_id": "flaws_cloudtrail:0000150:608f569b-9fd0-4759-bb3b-43adf3c92a8e", "row_index": 150, "timestamp": "2018-10-29T00:58:25Z", "event_type": "CreateVolume", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1513, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "608f569b-9fd0-4759-bb3b-43adf3c92a8e", "eventTime": "2018-10-29T00:58:25Z", "eventName": "CreateVolume", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: fiZ1IeRo84-kiSi9EXc2lXSoRfeHPzJHYscU-a0_9xyAxNnEf6vblEVJUZ792qS7E9LeZxP4WtUUG2QWMB-PI6v5HyiGQzG_2LWUWjUvdEOZq-yJKmWT0zsEGdZj4XKIQtf23l9tz2B58di48FDM4-acNLeuBAyBI8SujqfvEwigi42qb1qydxk-IkepzPIfnrodGeTShc0Ix0C_aKYiREZt0R_kUGCufTTpVxhw113OVAke-Yc1gw69WTLd8eAPBEEYxa5D57EoO0AzcjhbTROnebpVPoaLPcKyKKsqMzjHu58DEHnp8rWCM-2Fo3Ah42l2zgUds2yb4rZhs7NuJ1LFmIn4xOek5A05ppS_DPDnVQ6lpfWPTRfi5S0RGRaeYzGrWCu5JEAc3HihxWtsHaVzzsoPrHIfxT3ChJzitDA9gchks-PK6jLQ2mFHW2V_h_adVo87N9ByLNl55mtP1pKbR56l96hI6gFoJCh8g7AuZU2WMLidakddn77hj--RMFHheeIdyvNCXf-TgWUImAqvGLPjQgWIHizJ-E_zxQjwlpqLV8_0LzGf9kYnNS-SLW7IyTBFk2GUnYpzmpZJ7qJZXTSb_alYD86sL165Oun-i5uMZ8zquntQZEa96g", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "zone": "us-west-2a"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "586577d4f-ceec-4271-9715-714d755450dde", "record_id": "flaws_cloudtrail:0000151:586577d4f-ceec-4271-9715-714d755450dde", "row_index": 151, "timestamp": "2018-10-29T01:01:42Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.254.37", "user_agent": "aws-cli/1.16.5 Python/2.7.9 Windows/8 botocore/1.11.5", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 655, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "586577d4f-ceec-4271-9715-714d755450dde", "eventTime": "2018-10-29T01:01:42Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.254.37", "userAgent": "aws-cli/1.16.5 Python/2.7.9 Windows/8 botocore/1.11.5", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7c2cee5b-b3c4-4821-96ab-783f46bfd946", "record_id": "flaws_cloudtrail:0000152:7c2cee5b-b3c4-4821-96ab-783f46bfd946", "row_index": 152, "timestamp": "2018-10-29T01:02:01Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.254.37", "user_agent": "aws-cli/1.16.5 Python/2.7.9 Windows/8 botocore/1.11.5", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 688, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7c2cee5b-b3c4-4821-96ab-783f46bfd946", "eventTime": "2018-10-29T01:02:01Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.254.37", "userAgent": "aws-cli/1.16.5 Python/2.7.9 Windows/8 botocore/1.11.5", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7964f814-1311-459a-9c41-8b9d40e965671", "record_id": "flaws_cloudtrail:0000153:7964f814-1311-459a-9c41-8b9d40e965671", "row_index": 153, "timestamp": "2018-10-29T01:02:21Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.254.37", "user_agent": "aws-cli/1.16.5 Python/2.7.9 Windows/8 botocore/1.11.5", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 717, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7964f814-1311-459a-9c41-8b9d40e965671", "eventTime": "2018-10-29T01:02:21Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.254.37", "userAgent": "aws-cli/1.16.5 Python/2.7.9 Windows/8 botocore/1.11.5", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "794f6b34-e3e5-4af5-aa52-17c2a77055", "record_id": "flaws_cloudtrail:0000154:794f6b34-e3e5-4af5-aa52-17c2a77055", "row_index": 154, "timestamp": "2018-10-29T01:02:30Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.254.37", "user_agent": "aws-cli/1.16.5 Python/2.7.9 Windows/8 botocore/1.11.5", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 738, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "794f6b34-e3e5-4af5-aa52-17c2a77055", "eventTime": "2018-10-29T01:02:30Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.254.37", "userAgent": "aws-cli/1.16.5 Python/2.7.9 Windows/8 botocore/1.11.5", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "92e341429-40d4-42c4-af80-856a77a7b6ed", "record_id": "flaws_cloudtrail:0000155:92e341429-40d4-42c4-af80-856a77a7b6ed", "row_index": 155, "timestamp": "2018-10-29T01:03:03Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.254.37", "user_agent": "aws-cli/1.16.6 Python/3.6.4 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 658, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "92e341429-40d4-42c4-af80-856a77a7b6ed", "eventTime": "2018-10-29T01:03:03Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.254.37", "userAgent": "aws-cli/1.16.6 Python/3.6.4 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "498dd28b-969f-4ca0-8486-61110f0783b6", "record_id": "flaws_cloudtrail:0000156:498dd28b-969f-4ca0-8486-61110f0783b6", "row_index": 156, "timestamp": "2018-10-29T01:03:03Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.254.37", "user_agent": "aws-cli/1.16.5 Python/2.7.9 Windows/8 botocore/1.11.5", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 663, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "498dd28b-969f-4ca0-8486-61110f0783b6", "eventTime": "2018-10-29T01:03:03Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.254.37", "userAgent": "aws-cli/1.16.5 Python/2.7.9 Windows/8 botocore/1.11.5", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7a8b8c75-dd26-49d8-8729-7a09da7468d7", "record_id": "flaws_cloudtrail:0000157:7a8b8c75-dd26-49d8-8729-7a09da7468d7", "row_index": 157, "timestamp": "2018-10-29T01:03:11Z", "event_type": "GetPolicy202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.254.37", "user_agent": "aws-cli/1.16.5 Python/2.7.9 Windows/8 botocore/1.11.5", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 687, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7a8b8c75-dd26-49d8-8729-7a09da7468d7", "eventTime": "2018-10-29T01:03:11Z", "eventName": "GetPolicy202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.254.37", "userAgent": "aws-cli/1.16.5 Python/2.7.9 Windows/8 botocore/1.11.5", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"functionName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "266a1be3-cb79-4c0c-89c4-0beae5aea392", "record_id": "flaws_cloudtrail:0000158:266a1be3-cb79-4c0c-89c4-0beae5aea392", "row_index": 158, "timestamp": "2018-10-29T01:03:21Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.254.37", "user_agent": "aws-cli/1.16.5 Python/2.7.9 Windows/8 botocore/1.11.5", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 717, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "266a1be3-cb79-4c0c-89c4-0beae5aea392", "eventTime": "2018-10-29T01:03:21Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.254.37", "userAgent": "aws-cli/1.16.5 Python/2.7.9 Windows/8 botocore/1.11.5", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "421f2f63-3982-47d0-a510-423368f68aa4", "record_id": "flaws_cloudtrail:0000159:421f2f63-3982-47d0-a510-423368f68aa4", "row_index": 159, "timestamp": "2018-10-29T01:03:22Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.254.37", "user_agent": "aws-cli/1.16.6 Python/3.6.4 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 691, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "421f2f63-3982-47d0-a510-423368f68aa4", "eventTime": "2018-10-29T01:03:22Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.254.37", "userAgent": "aws-cli/1.16.6 Python/3.6.4 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "948452b76-357e-4e16-a643-466a764fd000", "record_id": "flaws_cloudtrail:0000160:948452b76-357e-4e16-a643-466a764fd000", "row_index": 160, "timestamp": "2018-10-29T01:03:29Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIA5O6EOMAFTD7BRPO1", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "254.108.71.86", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1031, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "948452b76-357e-4e16-a643-466a764fd000", "eventTime": "2018-10-29T01:03:29Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "254.108.71.86", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIA5O6EOMAFTD7BRPO1", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-10-29T00:19:36Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logStreamName": "2018/10/29/[$LATEST]ddf72b5a52d012ea729877a281745536", "logGroupName": "/aws/lambda/Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ab87308c-2a61-48b3-9d8f-f90192be4cb1", "record_id": "flaws_cloudtrail:0000161:ab87308c-2a61-48b3-9d8f-f90192be4cb1", "row_index": 161, "timestamp": "2018-10-29T01:04:16Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.254.37", "user_agent": "aws-cli/1.16.6 Python/3.6.4 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 720, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ab87308c-2a61-48b3-9d8f-f90192be4cb1", "eventTime": "2018-10-29T01:04:16Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.254.37", "userAgent": "aws-cli/1.16.6 Python/3.6.4 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ef3c4bc5-eda1-4736-8c59-8fa103405cb1b", "record_id": "flaws_cloudtrail:0000162:ef3c4bc5-eda1-4736-8c59-8fa103405cb1b", "row_index": 162, "timestamp": "2018-10-29T01:04:32Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.254.37", "user_agent": "aws-cli/1.16.6 Python/3.6.4 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 745, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ef3c4bc5-eda1-4736-8c59-8fa103405cb1b", "eventTime": "2018-10-29T01:04:32Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.254.37", "userAgent": "aws-cli/1.16.6 Python/3.6.4 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e9f28b56-b98d-4816-aed7-66cf3d04d022", "record_id": "flaws_cloudtrail:0000163:e9f28b56-b98d-4816-aed7-66cf3d04d022", "row_index": 163, "timestamp": "2018-10-29T01:05:19Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.254.37", "user_agent": "aws-cli/1.16.6 Python/3.6.4 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 673, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e9f28b56-b98d-4816-aed7-66cf3d04d022", "eventTime": "2018-10-29T01:05:19Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.254.37", "userAgent": "aws-cli/1.16.6 Python/3.6.4 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c182837f1-3612-4f70-a0e3-dc6a59bec91d", "record_id": "flaws_cloudtrail:0000164:c182837f1-3612-4f70-a0e3-dc6a59bec91d", "row_index": 164, "timestamp": "2018-10-29T01:05:42Z", "event_type": "GetPolicy202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.254.37", "user_agent": "aws-cli/1.16.6 Python/3.6.4 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 692, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c182837f1-3612-4f70-a0e3-dc6a59bec91d", "eventTime": "2018-10-29T01:05:42Z", "eventName": "GetPolicy202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.254.37", "userAgent": "aws-cli/1.16.6 Python/3.6.4 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"functionName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "509668ccb-32d1-49b2-8e05-2af9e6c197fd", "record_id": "flaws_cloudtrail:0000165:509668ccb-32d1-49b2-8e05-2af9e6c197fd", "row_index": 165, "timestamp": "2018-10-29T01:06:03Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.112.254.37", "user_agent": "aws-cli/1.16.6 Python/3.6.4 Darwin/18.0.0 botocore/1.11.6", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 722, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "509668ccb-32d1-49b2-8e05-2af9e6c197fd", "eventTime": "2018-10-29T01:06:03Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.112.254.37", "userAgent": "aws-cli/1.16.6 Python/3.6.4 Darwin/18.0.0 botocore/1.11.6", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4e0aebf2-b967-409b-8429-bca22fa56e63", "record_id": "flaws_cloudtrail:0000166:4e0aebf2-b967-409b-8429-bca22fa56e63", "row_index": 166, "timestamp": "2018-10-29T01:10:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1482, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4e0aebf2-b967-409b-8429-bca22fa56e63", "eventTime": "2018-10-29T01:10:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIADLD2800RXI7RLI50", "expiration": "Oct 29, 2018 7:30:51 AM", "sessionToken": "FQoGZXIvYXdzEGsaDIXahk5E63P8UwfAMCK3A6nVoIGo26w+hPCIIHV875p1wZ6oCJmtORrWohDU97DPt0ib0R994bWphI27AzWjeoa5CAbnrrYwrSXpwq1PHBwuZ96scSRhyGMfte7QnF1iHPvIPb2WkR/1pFiBP6hpKABiOukFt7T2/ticSXMaJDQ2LAxr3cj4JkKWULFuQI7+Eo7nAd1009ZoLOWMC/GlUUkO8DSxaiP8ItAAgGnXPdoIKlJWSElaGiewRg7KPX9t3j63zUlgtZKPnolqZGzgzkzIBhFOrvJ5Wvxyxaz6pDpjk20hm5mupZKC0QgXxx5DlAYA0WNoRgzDXWbDim0b5HMbY12b7mqMieeyOFuJ7Rl17bn68txs6WhugpuktuVo9AZCKK9Bzwr26h2BzY3lnEhIQv60LErtwSZymeYTIHkNwtQcJBQE2Y31U7ptYgoZCbyn9wQOqQKhptkt+kgfd78UogwuNpY0uaCWFikyQVTqBrlzWQ71tVM8CAqVtuHx/7NJfvCAa0rVmlu4MBLI3fCxbW/1Ysv4Dul3jftUxADvLE6ivGfH7eSjw2zSXMCqXTV/0VCDmRxQTheQMdRMFnq7Xalu74woo7zZ3gU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "420938acb-fb19-4b7e-9ccb-6dc720255b09", "record_id": "flaws_cloudtrail:0000167:420938acb-fb19-4b7e-9ccb-6dc720255b09", "row_index": 167, "timestamp": "2018-10-29T01:11:41Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "16.9.0.4", "user_agent": "[aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 647, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "420938acb-fb19-4b7e-9ccb-6dc720255b09", "eventTime": "2018-10-29T01:11:41Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.9.0.4", "userAgent": "[aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "63e9da92-62fa-4e74-889a-c94a765b1787", "record_id": "flaws_cloudtrail:0000168:63e9da92-62fa-4e74-889a-c94a765b1787", "row_index": 168, "timestamp": "2018-10-29T01:24:32Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 666, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "63e9da92-62fa-4e74-889a-c94a765b1787", "eventTime": "2018-10-29T01:24:32Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ad0daf19-284d-4394-af39-42aa3206d0ba", "record_id": "flaws_cloudtrail:0000169:ad0daf19-284d-4394-af39-42aa3206d0ba", "row_index": 169, "timestamp": "2018-10-29T01:26:55Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 698, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ad0daf19-284d-4394-af39-42aa3206d0ba", "eventTime": "2018-10-29T01:26:55Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5b7eb6dd-3178-4cbd-937a-8ca65e32f75e", "record_id": "flaws_cloudtrail:0000170:5b7eb6dd-3178-4cbd-937a-8ca65e32f75e", "row_index": 170, "timestamp": "2018-10-29T01:32:18Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 679, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5b7eb6dd-3178-4cbd-937a-8ca65e32f75e", "eventTime": "2018-10-29T01:32:18Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4284aa72-8bf6-41b2-beda-b77a920f5073", "record_id": "flaws_cloudtrail:0000171:4284aa72-8bf6-41b2-beda-b77a920f5073", "row_index": 171, "timestamp": "2018-10-29T01:33:03Z", "event_type": "GetPolicy202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 701, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4284aa72-8bf6-41b2-beda-b77a920f5073", "eventTime": "2018-10-29T01:33:03Z", "eventName": "GetPolicy202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"functionName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9e5b3061-0f33-4780-a1e8-445108af", "record_id": "flaws_cloudtrail:0000172:9e5b3061-0f33-4780-a1e8-445108af", "row_index": 172, "timestamp": "2018-10-29T01:34:57Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 726, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9e5b3061-0f33-4780-a1e8-445108af", "eventTime": "2018-10-29T01:34:57Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7316cdf3-4cb8-467d-a1a6-f82a928bc4ad", "record_id": "flaws_cloudtrail:0000173:7316cdf3-4cb8-467d-a1a6-f82a928bc4ad", "row_index": 173, "timestamp": "2018-10-29T01:42:48Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "16.9.0.4", "user_agent": "[aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 646, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7316cdf3-4cb8-467d-a1a6-f82a928bc4ad", "eventTime": "2018-10-29T01:42:48Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.9.0.4", "userAgent": "[aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cc8be230-619f-4fc5-9f29-fbb7489a117e", "record_id": "flaws_cloudtrail:0000174:cc8be230-619f-4fc5-9f29-fbb7489a117e", "row_index": 174, "timestamp": "2018-10-29T01:48:15Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "16.9.0.4", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 770, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cc8be230-619f-4fc5-9f29-fbb7489a117e", "eventTime": "2018-10-29T01:48:15Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.9.0.4", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5deca1ab-ee0e-4602-b7ba-387d9a9bbf25", "record_id": "flaws_cloudtrail:0000175:5deca1ab-ee0e-4602-b7ba-387d9a9bbf25", "row_index": 175, "timestamp": "2018-10-29T01:49:08Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "16.9.0.4", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 772, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5deca1ab-ee0e-4602-b7ba-387d9a9bbf25", "eventTime": "2018-10-29T01:49:08Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.9.0.4", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9b69749-e6c1-4035-b05f-6a5c0422b795", "record_id": "flaws_cloudtrail:0000176:9b69749-e6c1-4035-b05f-6a5c0422b795", "row_index": 176, "timestamp": "2018-10-29T01:49:40Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "16.9.0.4", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 786, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9b69749-e6c1-4035-b05f-6a5c0422b795", "eventTime": "2018-10-29T01:49:40Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.9.0.4", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c41368-5878-440d-9eca-7eeeee665eaf", "record_id": "flaws_cloudtrail:0000177:c41368-5878-440d-9eca-7eeeee665eaf", "row_index": 177, "timestamp": "2018-10-29T01:49:42Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.96.24.205", "user_agent": "[aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 652, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c41368-5878-440d-9eca-7eeeee665eaf", "eventTime": "2018-10-29T01:49:42Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.96.24.205", "userAgent": "[aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "db9890fd-b246-4850-8fb8-7705a037513", "record_id": "flaws_cloudtrail:0000178:db9890fd-b246-4850-8fb8-7705a037513", "row_index": 178, "timestamp": "2018-10-29T01:53:15Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.96.24.205", "user_agent": "[aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 648, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "db9890fd-b246-4850-8fb8-7705a037513", "eventTime": "2018-10-29T01:53:15Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.96.24.205", "userAgent": "[aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "16da4ecc-fc21-41b6-9b80-91cc1afebe33", "record_id": "flaws_cloudtrail:0000179:16da4ecc-fc21-41b6-9b80-91cc1afebe33", "row_index": 179, "timestamp": "2018-10-29T01:53:24Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "[aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 643, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "16da4ecc-fc21-41b6-9b80-91cc1afebe33", "eventTime": "2018-10-29T01:53:24Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "[aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e1e5dc76-dcaa-4064-b884-bdf24c6b5416", "record_id": "flaws_cloudtrail:0000180:e1e5dc76-dcaa-4064-b884-bdf24c6b5416", "row_index": 180, "timestamp": "2018-10-29T01:56:53Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 730, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e1e5dc76-dcaa-4064-b884-bdf24c6b5416", "eventTime": "2018-10-29T01:56:53Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d8fc143f-e32c-497e-ac7d-66f19e633809", "record_id": "flaws_cloudtrail:0000181:d8fc143f-e32c-497e-ac7d-66f19e633809", "row_index": 181, "timestamp": "2018-10-29T01:59:43Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 768, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d8fc143f-e32c-497e-ac7d-66f19e633809", "eventTime": "2018-10-29T01:59:43Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ea04c98e-22be-4d6a-8ed0-a59cb0c367438", "record_id": "flaws_cloudtrail:0000182:ea04c98e-22be-4d6a-8ed0-a59cb0c367438", "row_index": 182, "timestamp": "2018-10-29T02:00:22Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIA5O6EOMAFTD7BRPO1", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "37.179.153.119", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1032, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ea04c98e-22be-4d6a-8ed0-a59cb0c367438", "eventTime": "2018-10-29T02:00:22Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "37.179.153.119", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIA5O6EOMAFTD7BRPO1", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-10-29T00:19:36Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logGroupName": "/aws/lambda/Level6", "logStreamName": "2018/10/29/[$LATEST]7af9d44b08aa9ba7e642e527154bbef3"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "46519b9b-0720-4713-9b66-7b31c73c3ed3", "record_id": "flaws_cloudtrail:0000183:46519b9b-0720-4713-9b66-7b31c73c3ed3", "row_index": 183, "timestamp": "2018-10-29T02:01:36Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 749, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "46519b9b-0720-4713-9b66-7b31c73c3ed3", "eventTime": "2018-10-29T02:01:36Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a306610b-82ee-48ab-a86d-c1cd234a410d", "record_id": "flaws_cloudtrail:0000184:a306610b-82ee-48ab-a86d-c1cd234a410d", "row_index": 184, "timestamp": "2018-10-29T02:01:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a306610b-82ee-48ab-a86d-c1cd234a410d", "eventTime": "2018-10-29T02:01:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJXWWhiUVl2aUNaaEZlRmhRWDRUWnpCWDB2K1dTUUZSTS9oWURuTVVFcnVrOWJoYTA2dWZGMVhBdURCdVZDelppaVl3RnVOV01NNFgxS3FSdkNpSzFIcmhvVGxyY25WQVlVMGdFbnYxQmhmRVNuN1V0TlowdGtZRzQraDJGMDJUak1tSmMvUHN2aFFtNUNPSkRXM2hsMC9LV1VOR0hOVFMzV04rUzFOZmkvZkV1aVZWMHhvYkZkVzFrbDNUcjJ0Mk1MUC83IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4bf3b879-b747-4c1c-bf98-19f41e7d23c0", "record_id": "flaws_cloudtrail:0000185:4bf3b879-b747-4c1c-bf98-19f41e7d23c0", "row_index": 185, "timestamp": "2018-10-29T02:01:52Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4bf3b879-b747-4c1c-bf98-19f41e7d23c0", "eventTime": "2018-10-29T02:01:52Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJieXFXRStmVmJvMDFoazkvazlybjZDKzdPOXc1cWhlV0VJWkpIbVBsZm9VM1d0dFZmcWZraVRhN25ycXY2V2FvejAwRlZnV1cxRkNsaDJOTEN6UXEyYi9vWXM5UGZSVlZMa25SaWUzSmx1Rk5BNnZZeFRObGU3bkZDalNiQ3A5OEJNQktab2hkYkt6bVkxamNIWE4zNXNxTUhNR0pGU084QWtlbW03RXBTY0tvU1NBSVFlTlQwOUFhZXczS0cxTmNpUDRJIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "92c9d304-c89d-48bd-b8ee-7b74416952ff", "record_id": "flaws_cloudtrail:0000186:92c9d304-c89d-48bd-b8ee-7b74416952ff", "row_index": 186, "timestamp": "2018-10-29T02:01:55Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "92c9d304-c89d-48bd-b8ee-7b74416952ff", "eventTime": "2018-10-29T02:01:55Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJnUkpaV1VqZEd4Y0FGblBMV1JKN0tvajJKU3NRSzgzeHJGZTRFWnpCRUJ2STJMUnJldFQxSGVBcEJhRXdhVFJ6RE14ekpuQUd2cFZJSmxFeEYzNXZJV2tJM3pxWGpZNHdtYUd5WHYyUm1mZnVzSjJ6RU1uRzRONng3TThocU1udytvSGgzYy9pSFFLUnYyODFKWTN6dmxHUjNLN1czK1VuYmRBNUJWR3dZOFl0VHlVbHFGZlNOelNCRjMxd1QyVTdOMjY2IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c293021b5-96d5-4a89-815e-65f495c02557", "record_id": "flaws_cloudtrail:0000187:c293021b5-96d5-4a89-815e-65f495c02557", "row_index": 187, "timestamp": "2018-10-29T02:01:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1061, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c293021b5-96d5-4a89-815e-65f495c02557", "eventTime": "2018-10-29T02:01:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJrYjMxTGExczRKTGNUZ2tNYzhVaXZjdlh1NVNXR3VJdFBlamdtOURHazArc0xsYlp1a1lyWG8vZkZDVnJVMU5qTGNhYjhLVjltMFRHWXZGaEhVenlkQ0ZTeUJhVmRaMUVIVTl5QjN0dEx6bzRwTzNBOHBNdVZFdVJmcjZCQjllbmVSdkdKdkcvZjNjODQrRDhjd0ZJOUxxQzVJaUN3eDYzbGJVU0kvT21Mak0rdVJSVnhCQ0RGdlBBVVYvSWYzTC9GVUZrIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d026f100-c40d-4322-9307-f1aa9926d2f2", "record_id": "flaws_cloudtrail:0000188:d026f100-c40d-4322-9307-f1aa9926d2f2", "row_index": 188, "timestamp": "2018-10-29T02:01:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d026f100-c40d-4322-9307-f1aa9926d2f2", "eventTime": "2018-10-29T02:01:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJxSzdSZkJKWjJXVnF6bDlYc0hpUXJKMkdodXZWdm9OZXRpMDJDZ0duemdVa0YwemlOS241elQ3NWUwanp5aTUyTS9kQXhhaUowd0JOZU1FVWI4Z3FiWDFGNUsvYk1keDlTSnhLZDQyRCtpc3JlTzJmNXhmYngyUkNKWUNVNzJNcFc0SnpOb29IVDJaVkVLZ2FVUWViaEFuSmtkSWxqSjA1WHJRT1JCRUdEekdxVnpFYzBYRC81QldqZjNKVTE3N3ovZ25qIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "22369e-cabe-454a-971a-c096ed69c3b2", "record_id": "flaws_cloudtrail:0000189:22369e-cabe-454a-971a-c096ed69c3b2", "row_index": 189, "timestamp": "2018-10-29T02:01:59Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1058, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "22369e-cabe-454a-971a-c096ed69c3b2", "eventTime": "2018-10-29T02:01:59Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJSTEhRc2FjZ3Z5T0kwQ2pOOGJhY0VmSi9maHRyUWZpVEZveThpNTdpRUZ4a1lBVzhwNndhV0kvR3NLUzR2RkRiQ2VVOWExZHBQK2ZtYlJXd1VONmljUURVbG5oUzlzS3BtSjd4TFNHSGE2RlhmQjlvckQxV3dLMytGaWEvRlIwZ2o0S0VkMTZzdkpHa2I2U2lOZUdNWFF0WkNnYitrdTBRNkJFM083S2IrV3BPSXFrME9mRWtreXNFSnBEdG5Vd3NMQUJMIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "47f550bd-52e7-400a-b551-1cedd30962", "record_id": "flaws_cloudtrail:0000190:47f550bd-52e7-400a-b551-1cedd30962", "row_index": 190, "timestamp": "2018-10-29T02:02:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1058, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "47f550bd-52e7-400a-b551-1cedd30962", "eventTime": "2018-10-29T02:02:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJZeGFOd2RGTWg3N2xYMUZOOXBaYWFyTHNaYzRtME5VUG9iV1VvWXQyQjF5M05oWHlKaFNPNjdzWUgwTk1HckV0d3V1OC9WcDhEL2lPZmRSWjRrNStRK0FJV2ZJL05neGN6KzA4WFJlN0dVL3VPNktiZTJGUEJldm5WQ1NEQ1E3UjM5eHVQZGtqMGFaNGE5dXZuNDczL0lXUFR1cnd5Z25XL2x3ejkwS1pHVHlvTlAyalBzc1lzS1I2ZS9sbGxVUnRhKyttIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f1b397e3-d096-466b-be4f-49ec4ebb5855", "record_id": "flaws_cloudtrail:0000191:f1b397e3-d096-466b-be4f-49ec4ebb5855", "row_index": 191, "timestamp": "2018-10-29T02:02:02Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1057, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f1b397e3-d096-466b-be4f-49ec4ebb5855", "eventTime": "2018-10-29T02:02:02Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJDVTNxb1ZueUs4YitmMnRHRzR0VVk3MUJtdzh2bjhUNUV2UGlNQXJvN2dtdDlVRTZxKzg3OGw0ZTU2SzVoSUJjM2hVajZMVGRlUW1qUFBML2RZWVAzbGZydjN3aWh1R0p2SmYrN0NxT2Jhd2tGUDJ6ZU55TGhhd0Mza0NvbDBZMCtGMkNRQzRPL0Yzb05ydlMxeFpOWHVaV0RiRGdyR2F1RnBrMXlhSGZ2NG9wbnFEVjl0RGNVQjE2TGQ0UzZBR2NJK2RWIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a4ba14bc-5c5a-41e8-a808-d5e82bc3dc55", "record_id": "flaws_cloudtrail:0000192:a4ba14bc-5c5a-41e8-a808-d5e82bc3dc55", "row_index": 192, "timestamp": "2018-10-29T02:02:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a4ba14bc-5c5a-41e8-a808-d5e82bc3dc55", "eventTime": "2018-10-29T02:02:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJObnlIbFpnTnRpYjFoS1lWMkhXUmhIM05VWUdyTW83dU1rS1RwWHlqbEtBSkhFZ2ZhRjBDY1hGNXNmT043WVNQK3kvMWVGVVoydVRac3pLQTVQeVlkZFV1ZGF5SWtEU0RKd2xGSGtpRndkSklTc0pVcnRLYXFwdEpPK2ZyWGZyZGxaNzAyanNHSGk4MjFhaGF3dThjWExPblF2NEJ6R1pESTgwNDRwSUh0SEFRY2xkczZCSVNQUElLRDN6eFF4a0U2dz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7471c816-fff3-450f-8cfb-272884f4b773", "record_id": "flaws_cloudtrail:0000193:7471c816-fff3-450f-8cfb-272884f4b773", "row_index": 193, "timestamp": "2018-10-29T02:02:05Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7471c816-fff3-450f-8cfb-272884f4b773", "eventTime": "2018-10-29T02:02:05Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJTak1LR3dVUCt4ZzlTREpRK2pvK3F3eWpkc09YZ0RSaTBQcUhvMkhQaDdTWlVXeStLa0RsU0ZTY3NhRFRTM2ZGUFluYlJvN3M4RmdkNVJ6RFQySFVoRXM0SzQrQ3hZZ2t5NmhmVWJxc3VPbENYR1ROMVBSczg0cVZnWTEzUjhFUlJBSXYxZ2R6Vy9EOXhaRG51MTlkK1dLdjBCY0NBZnFMNXRrZ0xjd3BXTDNzZXdkLzBSaytxTjBpVTk3MGJib0F6WFpYIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ae9e522f-12a0-462d-8545-7cb833069bb", "record_id": "flaws_cloudtrail:0000194:ae9e522f-12a0-462d-8545-7cb833069bb", "row_index": 194, "timestamp": "2018-10-29T02:02:08Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1059, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ae9e522f-12a0-462d-8545-7cb833069bb", "eventTime": "2018-10-29T02:02:08Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJqYXVmWXJ4ay85SUVoSTFSaUVjalhLT2xCZnkwUjRHYmFINmdUSDVtSWZIbkl0TEFvbzE2VzJPWHJTV2xpdjc4VVZZN0d6VnlyL1EwZ1VoRnorU1YydkpTQmhTUlVMdlRSNFBWZXRaTW9aN0V4cEx3WXllYUJDeDlsbXZoM0RqdStLNG95VXFwZ21xRHE2SHF2WkhvZmY1VDdNUmx3ajAzbVBTRHphZ3J0NCtiSUxiRjRPY0h5V2VEVDdmYi9oeU4xdmtiIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "46817db5-65a8-48e8-8f3d-886a8b2f6ceb", "record_id": "flaws_cloudtrail:0000195:46817db5-65a8-48e8-8f3d-886a8b2f6ceb", "row_index": 195, "timestamp": "2018-10-29T02:02:10Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "46817db5-65a8-48e8-8f3d-886a8b2f6ceb", "eventTime": "2018-10-29T02:02:10Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJqMzJWWTNHRVhENzF5MWJEWGNXK2traUh4ZG9jSWRMSUl0TS9CRmZuVnNPOW00a1YrN1ByUlZLN0kvRjh2cFFkOVBGdzF6ZFZ2ejE3RjhqekF3dEFNR0RPcm5zaGVMWjdyV1M1S0ZjY1JPeUhHUVNuWGhRSGdsaDg2bWpSeDNsNWF4L0FHUVNHZmxFMTVDZStNcUtHTjVsTm83WXdNTHZteGNqTVJhV2h0TXNzUTY2V1A4UTBrTWEwUnlEVlpIOWhZd2FRIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5b0d3d2a-9aad-491b-bcbf-9af2a2cda338", "record_id": "flaws_cloudtrail:0000196:5b0d3d2a-9aad-491b-bcbf-9af2a2cda338", "row_index": 196, "timestamp": "2018-10-29T02:02:11Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1060, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5b0d3d2a-9aad-491b-bcbf-9af2a2cda338", "eventTime": "2018-10-29T02:02:11Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJWMXliZ01Bdi9SeExOYXBRV0xFTk5QYzhWeFJDeHphNG0rVUdWTzRVUWgwMHY4ZGRUd0Njd0NldUpwL3FSUE9EZk9rTTFQb0VmMVYrWnFQcGdqRGJ5WnNMbWNueGpEQ3FMR1k4cW1JdjlmQTg2OCtaODZTdk9WZWJuWUgwQ0ptQUp0aE0yc3dOL1VReUU3YmlNNXk5NTZ0aDVvbjlkYzhwWkQ1Qm9laS9YYXkxMERrNDN6ZmtGTHlIQzAvK3VHY1BicnR4IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "54133db4-e611-47e2-bfae-86614a97035c", "record_id": "flaws_cloudtrail:0000197:54133db4-e611-47e2-bfae-86614a97035c", "row_index": 197, "timestamp": "2018-10-29T02:02:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1084, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "54133db4-e611-47e2-bfae-86614a97035c", "eventTime": "2018-10-29T02:02:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwZXdNaG8zNWVDbEZEbHhmTU8yWjloTnpDdkFLMThqQ0VOQW9tU0ZRVjUrd2t0Mzl6YloyZ3NPOENFeEZLRDZjWDhQblk0ZCs2cWZMNzFadTA5d2p4TFAwOVpwOE41eEo3MFkxbUZYVFlMc25VRXNocWZjUkpRdTg0anNVK2p3K25OMllTR1BpZFZLWFM3YlY2OXV0QkprTTJmQUNJMXkvSEdaSGlBVlA4Z2oza0tSeXlNclF3UzZkNGVzZnFpWGlxaW5nMTVXNHIxbkc5VjB0S1hMWk5RPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "42ba5ba1-79e4-47ff-bc48-fa4ede8d2d32", "record_id": "flaws_cloudtrail:0000198:42ba5ba1-79e4-47ff-bc48-fa4ede8d2d32", "row_index": 198, "timestamp": "2018-10-29T02:02:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1083, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "42ba5ba1-79e4-47ff-bc48-fa4ede8d2d32", "eventTime": "2018-10-29T02:02:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJsdDVyaHMyZk54VzFNQmpWcTJaLzVSQ3F6RGtnZ1lzSXdhbDRURmVZRHczMmpZOGx4a2tjWWFZMWY0c0l5emc1MlFLZFBibDQ5ZGxnL01UU0szVjgzd3ZGTnU1NVlPY1o0RWIyZ0xQM0xFZ25HOWJXaHNsd0ZVWHNlNm5WVjZNbXlmbVdsVjNFcy9QT0orOWczeXFXOU5zenNxM0c4RW92QmxNcFdmemhHMGxLWUQyWGFoOHFNSGc4b2RudnBpa3pSeG44VEc5eFllOVZVazMvcG4rTERBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ea2d093c-325a-404e-aad1-9505b47a5db8", "record_id": "flaws_cloudtrail:0000199:ea2d093c-325a-404e-aad1-9505b47a5db8", "row_index": 199, "timestamp": "2018-10-29T02:02:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1084, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ea2d093c-325a-404e-aad1-9505b47a5db8", "eventTime": "2018-10-29T02:02:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2L0pxdGQ4YlRwaHk5OFJzbXNsZkJkSm1jZmhLTVRVUFFXQmJMWHlRbGJSZVpHY2JMUWVlU3RleGNIa2JWdXVJQ0tMU3ArdVRZbkVNeGZIZ1I5UDdwV3NobUx6UnJQM1Q1a3lCOXNuUDJtMVgveUhZajJrMmJuM29HVHdGd0s4alN0d0hGa2VlYmw1azhibEw5VDFqVUJyblBQVzhIRkdqRkt2VEc4ak03bUJoMFhDNUJGUnNCZC9RT2hFek9MTmVqUWNqa1Y3b2JhcVRvM1pmVWZGRXN3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e585935b-b977-432c-af1d-27d4eeed408b", "record_id": "flaws_cloudtrail:0000200:e585935b-b977-432c-af1d-27d4eeed408b", "row_index": 200, "timestamp": "2018-10-29T02:02:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1052, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e585935b-b977-432c-af1d-27d4eeed408b", "eventTime": "2018-10-29T02:02:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJhQU9GSDlsUzBHZXE3S0VxL3lHT3dJNGRhMnFVRnZvaXJlb0dONnRvS3ZYQkRmaitJT09zSDBSY282aVppcWhYQjJtQk8zV2ZjOGVNZDVqUnNmZUdkNGVVSTRaWFpNSU9nUVNsMEJPcHdjR29VTTNnMW5OMXh6ZDNHYlh5Y3lrOExBQW41ajUxQ3VmdGZ2eHZSdi9SK3kwNDFielZ2S3RQemkvUVJSSGVnbTZtYXpwY3JCNnViL2FQRm5VSkk2UUkiLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7d12c7bf-64f1-48d2-be73-b0f853d1e248", "record_id": "flaws_cloudtrail:0000201:7d12c7bf-64f1-48d2-be73-b0f853d1e248", "row_index": 201, "timestamp": "2018-10-29T02:02:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1084, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7d12c7bf-64f1-48d2-be73-b0f853d1e248", "eventTime": "2018-10-29T02:02:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJRNDNyVWxLbzhxQU5udzUrclI4S1JVb3RNR0tXL1JVVnA5YWYyNGhpcnM3MnRzand3eDU2bnBRVUYvblg3OXorUHNUUGZxY2RHd1I2bnZ0ZXh3cWJSUlc4SnY1dHZXNG1rVW54MWZvVy9DYStoL2I0czh0d0p5TWJtTWRackNUQlFBMHdqbks3QnVaeThkWll3YUkvcDdBRmNxRWVBUTZXWGFSZnpZU05IZEZmUWl6L2FGYlB5cTN4WHNKOFQ2OFpvcDh3UDFFSFJOWUJ1K1Y5dTlpTC9RPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f7068c9e-2dec-41d7-91a3-5b7ea734911", "record_id": "flaws_cloudtrail:0000202:f7068c9e-2dec-41d7-91a3-5b7ea734911", "row_index": 202, "timestamp": "2018-10-29T02:02:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1081, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f7068c9e-2dec-41d7-91a3-5b7ea734911", "eventTime": "2018-10-29T02:02:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ5SXpBV0VSTVlkalAwMkYvLzFoV2ZDOXZDTzBFaDNKL3NtaXVFMmFuZUlIdU1pdUNQWkE2M1pJSlY0ZC9CcVUwbEZ6enltSDB1bXJhNUdtVG1hUWc5ayt0aFNUNEliT1RvMlVXbTFuZXFEK0lkN28zVnFNUnUwU2RtTFI2QUU1dWFrcWdUdDdaUVhpSzU5SlNiZ210NzJ0MVc5WW9kYzVqdHIrcXozY2FZNlp2TG1ycmpvUk5GUm5yQlNiK0pyY3FkWjNCdlFFc1NEcXpCVXY0dUl0bGx3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "385db598-2a01-47cd-99e2-b2ddc86c78c4", "record_id": "flaws_cloudtrail:0000203:385db598-2a01-47cd-99e2-b2ddc86c78c4", "row_index": 203, "timestamp": "2018-10-29T02:02:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 783, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "385db598-2a01-47cd-99e2-b2ddc86c78c4", "eventTime": "2018-10-29T02:02:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "08ab841f-d772-4f1e-bceb-b900110b297f", "record_id": "flaws_cloudtrail:0000204:08ab841f-d772-4f1e-bceb-b900110b297f", "row_index": 204, "timestamp": "2018-10-29T02:02:41Z", "event_type": "CreateVolume", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "16.9.0.4", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1509, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "08ab841f-d772-4f1e-bceb-b900110b297f", "eventTime": "2018-10-29T02:02:41Z", "eventName": "CreateVolume", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.9.0.4", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: Hn1xRLhUuYRuB4QlrAISIoMU9cMa_q7Z1y5LU7QCKZVGfJ2jBv5ZUNrcMAG3be9B8mmRuC_-L11UBKxhuzgrkaUuCB77JtdXuUedzl0MOCq_qmiiTfq3u-5bbiaPvOOm7q1G9nXgUfXvc_dko5hZYR1KQHbwcbNBN5BS6ynI_H8JxIGeXslIVyenCpAX0CqEgLNiUMAg-CA9xL_-fBEbjRNIlBLcZpi45IUSF1u0RC9ABpHKROQUlNUQm09jL7gZJEQFA5jwM_ARDnvSFMzqC7YKuaxYDZHgXFcBOawBk5ga5NoGhnH8ISsdJjORhWp0Jvpl7QfS-5pXHC2DcaW_AGmIOS7Vf_ceN9Uy_CD57kkY1dixXlJGjZWaR50rlwssCcw2fy0zMk-bcN3GXjyXX7Sq4lhgXyQhgBGa-pciWR7rMRtJut50a1Rg2NLa6l03cp2wNRNVVxeytY59_MKFvvHogndgOHIkBs314yAHwEVzzIXZDDXgiVYoukbE3U0NwWND8Atoi6y-ScnzlyMEK4aUG7HV3FnZdwwneNiNmTgmHa5UsC7QqFflPP_DjZeZc4xKw2RslPfAd6b5BvZvFgVjxFrv9MFb8g31HRHtnptYgsKj_82vnVSBZum0_A", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "zone": "us-west-2a"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4a1acf36-6ac5-4df8-b51a-3fb815bb5c6b", "record_id": "flaws_cloudtrail:0000205:4a1acf36-6ac5-4df8-b51a-3fb815bb5c6b", "row_index": 205, "timestamp": "2018-10-29T02:03:43Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "[aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32]", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 653, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4a1acf36-6ac5-4df8-b51a-3fb815bb5c6b", "eventTime": "2018-10-29T02:03:43Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "[aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32]", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6bc2785f-4a46-4019-a07e-25de01adeaf0", "record_id": "flaws_cloudtrail:0000206:6bc2785f-4a46-4019-a07e-25de01adeaf0", "row_index": 206, "timestamp": "2018-10-29T02:08:48Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.96.24.205", "user_agent": "aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 778, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6bc2785f-4a46-4019-a07e-25de01adeaf0", "eventTime": "2018-10-29T02:08:48Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.96.24.205", "userAgent": "aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5dc3c60e-280e-4141-b7a9-01cbfe415c98", "record_id": "flaws_cloudtrail:0000207:5dc3c60e-280e-4141-b7a9-01cbfe415c98", "row_index": 207, "timestamp": "2018-10-29T02:09:18Z", "event_type": "CreateVolume", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1504, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5dc3c60e-280e-4141-b7a9-01cbfe415c98", "eventTime": "2018-10-29T02:09:18Z", "eventName": "CreateVolume", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: 0LLH5mRKyxNZ3ZoWkTLmiHB7jIW3Q2BAeGNum8prVgAV0zzjhCns2Gga0zWTWsPkQKTGk1yK_GZEHOtKz-_tJ6Im2-_i5_Q1zzUMHCA6WRindHwjIeAeReEw7J4cJWxEeloU29AdUKxwHMG--Isgm34sz_p6lGi1OuGY0Cecz8GFzYEfeNcfowOoZ96qExRBWUkK36lVEzOhwsQCJ0mhMMew6_LJ4XHyb883QUtBmbdt0yt92vy6vHh_jlihfJzi_tniHhYgL3Xt54jh9y5HxmPUl5jBoEuA4u9Q2tJ1-57yXwW6AUv3fY-_HMPTJS0LwsI2DTXLoj0sAtQV3FC-_4-zku-2toMCSLmb2ITUR5JmKAGzZVOBwBJYZpqzI7VXI8cKI7U-dvb093-Ul2epT2aTuQjE5KKeiKrHMIsNbQQwn971CNVC1UlZy7OpLCCuIoSGCONnW_njsKp-RRMOezMojPc5x4_tZCnVQmWG815TKoba3NfcDEeqB4Zg38RlIM8cYuPiTnCOABdAXdaLDX_EIAiNBvEfReEZWU3VULCW7hOGUBZeaBIox3GYgAtWHEdudSNpf4kv8z3m3wD2AxjGs4QIKcHARWjy0-q83gYzgpZvq9VwPCZdJPQPLQ", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "zone": "us-west-2a"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b60ca224-f1e0-4fef-8ad3-399758b500", "record_id": "flaws_cloudtrail:0000208:b60ca224-f1e0-4fef-8ad3-399758b500", "row_index": 208, "timestamp": "2018-10-29T02:10:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1480, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b60ca224-f1e0-4fef-8ad3-399758b500", "eventTime": "2018-10-29T02:10:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIAPXLL4TUVTUPVHBT0", "expiration": "Oct 29, 2018 8:25:32 AM", "sessionToken": "FQoGZXIvYXdzEGwaDEJuLHdHGqWmSuVyxyK3A7pE+xT4RijUpUZkx9ePNtGkfNpgQy1NysQOi/jrSnMwjUuxV/cJUvu5mKwgztsCRNGTxuxi+K0eN5f65uPtQShjF3QkqQ5P4qXMBRcFA4SfCVOC1LPneLdwTFivNjWRu5imax+c5pAFRFMJVnAI9W+j3gOEjLLmuLJEZuuDq/DJkGxw6DiKbCDUnCOSnkPAmHeDg47fynRPD08a5+ekX/VWjokBuT4OWwS8E3dHpMWgtBUnkS4ZmvExoviM8IzkfMxr1D/dilHcMZzheQL24cbXo77skdyRPHB8wjl6GpfC+tv4D9crYQjopGPIxl1+coLouOhT49L0/pit2BuMzSxneqUdW9DfC6EUsGAK5WnFIt5W5bOohK19DZUOSYC5PIBCuhLF4pRT7p9aHW+GSFwMr+g2RmzQoZg1SJOgVrZS6VGZA9uiVep0cE4/jyaqJ9dMMhluqGJ6fS+A2R01w2DlZkMMUYulZhOXo2dsOSf/HT7jYhj+UyCekmeBdh/+LNnICv9CJ7cC6WfRaqZwmRi2CdL9+qYjhTCFs/zfXtMJfVJP+JRTtJusSI1Z5XiJeT0kOPVmdKcos9jZ3gU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b981030f4-ee32-46d1-87c0-fdff104485aa7", "record_id": "flaws_cloudtrail:0000209:b981030f4-ee32-46d1-87c0-fdff104485aa7", "row_index": 209, "timestamp": "2018-10-29T02:11:05Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 785, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b981030f4-ee32-46d1-87c0-fdff104485aa7", "eventTime": "2018-10-29T02:11:05Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "72230e-e5cd-46b5-b5f3-44b853991c", "record_id": "flaws_cloudtrail:0000210:72230e-e5cd-46b5-b5f3-44b853991c", "row_index": 210, "timestamp": "2018-10-29T02:13:05Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 779, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "72230e-e5cd-46b5-b5f3-44b853991c", "eventTime": "2018-10-29T02:13:05Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f8c38936-6a60-405d-a157-e1b938f5983b", "record_id": "flaws_cloudtrail:0000211:f8c38936-6a60-405d-a157-e1b938f5983b", "row_index": 211, "timestamp": "2018-10-29T02:14:41Z", "event_type": "CreateVolume", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 812, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f8c38936-6a60-405d-a157-e1b938f5983b", "eventTime": "2018-10-29T02:14:41Z", "eventName": "CreateVolume", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "errorCode": "Client.InvalidZone.NotFound", "errorMessage": "The zone 'us-west-2' does not exist.", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "zone": "us-west-2"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "96a0f0eb-6a38-4c39-8712-fb2b7fdc9ae2", "record_id": "flaws_cloudtrail:0000212:96a0f0eb-6a38-4c39-8712-fb2b7fdc9ae2", "row_index": 212, "timestamp": "2018-10-29T02:16:37Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "[aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 636, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "96a0f0eb-6a38-4c39-8712-fb2b7fdc9ae2", "eventTime": "2018-10-29T02:16:37Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "[aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0]", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5d6388ae-ed07-4dbd-8a31-7caf84a8dd10", "record_id": "flaws_cloudtrail:0000213:5d6388ae-ed07-4dbd-8a31-7caf84a8dd10", "row_index": 213, "timestamp": "2018-10-29T02:16:47Z", "event_type": "CreateVolume", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1504, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5d6388ae-ed07-4dbd-8a31-7caf84a8dd10", "eventTime": "2018-10-29T02:16:47Z", "eventName": "CreateVolume", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: ktrtp_jKHRSd9XflFoq1_VQypmh8h_nbhLfdDMFMwqFi4eS3m_65Rwg2ZQeU5wveq7Q4CUBGoyvfTL2geAcd3WUBtIE4w84uOmKwIZLfIthTVTtxoDPkCpBJdXQ-Ge46hDPBrylW5qu-nhVxIRzJr_OTXTZPI-c3vIEkJN4Y0v3nU4jWGsTr0bwHN_jqh7hkjffErfX52m004S13EnKaslRNvMOHknG_qhLrKC92AwOLpq6WPKybeoMf3DLgE08GzFGf6A2JJjcG_-rKahrrKmObxGq0N_ODWeMxv6F1fhCRd2Qwkg8w-UtYxH6slt2NZRecZkTjiiOwyk405bplQTbBvVBhUFs6QhlqySAGtoYGo1L63mD_rwzCcbMiWNLre8w8Ky5akCJ5vyovgqAv_scjbtapKIP0nQ-ULa9lhjm0gwCLxmXpOC7L9tuhai0i8ggX3l2gxA99O5N39FQyb5f8ChNTkE506Wrc0HGlkww0lC-1kBA8FcRxbCla0HCenETQMR6PT9LtlvuzUa3y305RJ4g1JWcaxwTOhtCSYb8xK58QmtwoDbqIwuwvj8Z7z5QmQVfANMO9neWCDbmB7YCXpfd2dgkvhANWd4Ap6G-SDDB0643mXDK6-xuSPQ", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "zone": "us-west-2a"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "75c6aebe-7a02-4de9-8699-a2cb9e63a160", "record_id": "flaws_cloudtrail:0000214:75c6aebe-7a02-4de9-8699-a2cb9e63a160", "row_index": 214, "timestamp": "2018-10-29T02:16:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.96.24.205", "user_agent": "aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 794, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "75c6aebe-7a02-4de9-8699-a2cb9e63a160", "eventTime": "2018-10-29T02:16:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.96.24.205", "userAgent": "aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "77e4db12-6182-49db-98d4-0357bd09c89d", "record_id": "flaws_cloudtrail:0000215:77e4db12-6182-49db-98d4-0357bd09c89d", "row_index": 215, "timestamp": "2018-10-29T02:18:16Z", "event_type": "GetCallerIdentity", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 762, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "77e4db12-6182-49db-98d4-0357bd09c89d", "eventTime": "2018-10-29T02:18:16Z", "eventName": "GetCallerIdentity", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "responseElements": {"userId": "AIDA9BO36HFBHKGJAO9C1", "account": "811596193553", "arn": "arn:aws:iam::811596193553:user/backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "387f466a-20ef-453c-be11-14c72a3e39b1", "record_id": "flaws_cloudtrail:0000216:387f466a-20ef-453c-be11-14c72a3e39b1", "row_index": 216, "timestamp": "2018-10-29T02:18:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 777, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "387f466a-20ef-453c-be11-14c72a3e39b1", "eventTime": "2018-10-29T02:18:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0db2d151-e749-4a17-8ff7-88e372d04e8b", "record_id": "flaws_cloudtrail:0000217:0db2d151-e749-4a17-8ff7-88e372d04e8b", "row_index": 217, "timestamp": "2018-10-29T02:19:20Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 743, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0db2d151-e749-4a17-8ff7-88e372d04e8b", "eventTime": "2018-10-29T02:19:20Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9fd08013-cfa7-44e4-9383-cdf4b843b30f", "record_id": "flaws_cloudtrail:0000218:9fd08013-cfa7-44e4-9383-cdf4b843b30f", "row_index": 218, "timestamp": "2018-10-29T02:19:23Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9fd08013-cfa7-44e4-9383-cdf4b843b30f", "eventTime": "2018-10-29T02:19:23Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJDVjFlODFRdERDanJ4NHJaZ0RZSnMvS290ajQ1ZzBVOU5LbmpSSDFXZE83dVJMaENmM1hRZWdRNjRoS0JNSDkzRkF5WkhKVWJrdU1mdGZUMWoxdFBWVUhYaS9SblRrajZsSStzK3hwMTgyMkRIQnFFZkRlVTlWRTc5bFRCczJNUE1VT2sxa1dEY3NwOFljOVdJeUlOOVNnWU8zcVhwaWxNKzc3QlA3cms4aG8wNGpCQVpiSEtKb2pCcy93ZTNFZVFwNGE2IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eb5a26f4-a7b5-4eb3-89dc-d0aeecbec26d", "record_id": "flaws_cloudtrail:0000219:eb5a26f4-a7b5-4eb3-89dc-d0aeecbec26d", "row_index": 219, "timestamp": "2018-10-29T02:19:25Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eb5a26f4-a7b5-4eb3-89dc-d0aeecbec26d", "eventTime": "2018-10-29T02:19:25Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJoanVKdExXb3pXSllrSU1uVUJTbGs5WVhYbkFYT0dLMWZwK0pIVStQMUFYcng2M211cFAyb2xzaUJCQUZTQUxkbkJCaFcwQlBuVFFoL1N3MkVBOTE4WHZjSjBHczRHREYzdVhsWWxUUk9teGF5UUNsVjZ1VTJPQ2tCd2hXREh3SVFYV3AzZ1FFamJ3dExrTSttdzVGbzM3cm5CWTVXT3pObEtLRzRCL2R2REl4azlEVDNuYjF6QnA0Q0JmYlZiRjQvdUhuIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "134322d-6511-46de-91e4-a311567c6d52e", "record_id": "flaws_cloudtrail:0000220:134322d-6511-46de-91e4-a311567c6d52e", "row_index": 220, "timestamp": "2018-10-29T02:19:27Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1053, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "134322d-6511-46de-91e4-a311567c6d52e", "eventTime": "2018-10-29T02:19:27Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwVENkL21KTUNUSUZaMjNvaGZMTk45anJRUkxpdndLMmlDS0VyQis3emtxQkZqRGROajhGNWkyVnVGOWVBOEsrWmFPelc3ZkdHTGtnamNtcWNwWTg4eFBMb0JVK1lKb3EzY2Q3NlRoV2Y3UW1tZGZsc2FJblp3aW80YWgrbm55VkZCbUFTMkpYU3Z6cDVqL2JCbnoyclNPN2JVVjdNUnNpYWc0V1hMM1pzWi9JWVpJZGQyVG5oYmNwTGdFdjlSZWdES1cwIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "974434dcc-c280-465a-acd0-4c110035d5c", "record_id": "flaws_cloudtrail:0000221:974434dcc-c280-465a-acd0-4c110035d5c", "row_index": 221, "timestamp": "2018-10-29T02:19:28Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "974434dcc-c280-465a-acd0-4c110035d5c", "eventTime": "2018-10-29T02:19:28Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2ckZ6eUxpcHZtOXZmTkRRT0JXQ1R2WXMwVi94Qk9WQkQ2dHVaRE8xZGVMMGRsd1NQQ0FiclJLdnE3eVZ5ZWxaRzQ4aEZUUml6Ky84T3NGNkd0MHlFWjZRVHd4bW9FTSt3bktkK2N1VXpHVm41S0hvQi94NUs4NmJEMVJGbHkxL2ZhZlJwaExlTDljNVptdllzR3VJSUNoL0dUQ3RjcWlWZUtmcVh3Mi8wMmpjMDVUdDVqdDdkRnRVbmVObm1TMm45YXdnIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8b89678-f953-48b3-a5b5-1dbdedd93378", "record_id": "flaws_cloudtrail:0000222:8b89678-f953-48b3-a5b5-1dbdedd93378", "row_index": 222, "timestamp": "2018-10-29T02:19:30Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1043, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8b89678-f953-48b3-a5b5-1dbdedd93378", "eventTime": "2018-10-29T02:19:30Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJwQmZ6NXZkNDdHWmlDZnhWeVNydDFkL1AxNHJaWGpQTWN5Yi9hSGhMR0NNYmRLSEcrNTIxRWZYTDFTNmViVjhobG81MHNhTk9qWlJGZG1CSVB1bjI3a3c2SnJKUTNaMzNLdWFzUmhkZmlSNGdJUHhQNkVzcUZIRkpLMFR1VkJTdHpWUmVjNzhPekJGQnJTamxIR2hNdUhLYkVVR2lzUFhoOFk2eVQzY0s3RlY3NmkwQ2Rwcnd0a2xQKzlwK0ducz0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5eeb8bb5-2948-45bb-af3e-61bb20b2e5b7", "record_id": "flaws_cloudtrail:0000223:5eeb8bb5-2948-45bb-af3e-61bb20b2e5b7", "row_index": 223, "timestamp": "2018-10-29T02:19:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5eeb8bb5-2948-45bb-af3e-61bb20b2e5b7", "eventTime": "2018-10-29T02:19:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJLOTduQlV2bnJ0Y2dQaFcwSjROY1h6eC9FN1loNjZsRm9SQVdpTlFRQUdkQlhZNlZ6UVFzZUtVdFRkd3RFNnp1RndJWUVHSWZTRmFUMVZjeEI2OTBTbUJKQ1paYXQxYkwrTXY0YjllQzhrS0UvWFkweWhJWDF1dElwdFptZndyV0JHQ0ZNZENhbjlIYTdSK0VyZ1JKWjJKWGpxK05sVUIwVHFjZ1JLRHpzMmJwNnV1WExpT0l1WjB3SGIyQzN2MzZhZHlDIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d3ac1a76-0a14-4ea8-bbcc-794858c4e966", "record_id": "flaws_cloudtrail:0000224:d3ac1a76-0a14-4ea8-bbcc-794858c4e966", "row_index": 224, "timestamp": "2018-10-29T02:19:31Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 798, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d3ac1a76-0a14-4ea8-bbcc-794858c4e966", "eventTime": "2018-10-29T02:19:31Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d96c7d0c-dd58-438f-b35b-4e98d93c48d5", "record_id": "flaws_cloudtrail:0000225:d96c7d0c-dd58-438f-b35b-4e98d93c48d5", "row_index": 225, "timestamp": "2018-10-29T02:19:33Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d96c7d0c-dd58-438f-b35b-4e98d93c48d5", "eventTime": "2018-10-29T02:19:33Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJJa3QvWTNOc3dqbURydlpyZGpwRisvWnRtWkp5a3JXc2lkVnhMY2h0aGlTTnZTZUdiZFFxRm5QOUpYZWc4ekpETHJYSXd3YWlrTFVYWVlVNStnSFpMUGhpVDNxeGFZcldYYzF3eEFJN2VqNCtyTk9mTWpTRW9DOFFrTG1tVTBldCtWUk5TZWErVnI2dzUreHlaQ2FCeHZIZGtBVkwvYXhZTjdUWHVZdnQxbnVpbUI5QW5mZnNnUmR4Zk5IcGpWbnl4TWQxIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "989cf216-40ed-4028-94fa-3bc014e439d9", "record_id": "flaws_cloudtrail:0000226:989cf216-40ed-4028-94fa-3bc014e439d9", "row_index": 226, "timestamp": "2018-10-29T02:19:34Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "989cf216-40ed-4028-94fa-3bc014e439d9", "eventTime": "2018-10-29T02:19:34Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJJY2ZzcUZ4cHBHeHVkSUFoTU5wMVRpMTMzYmM1Um9Qdmk4TTFzMjdySXdndEZneHFYbndNRk9zMDlUWnp5SERtRCtoVVFPTUVkYXQyOXpITi8zMG5EMG1iT2s3eU5hWEptWFdDbDlwRmIrbkRJVHhNSFo3UUpSSDFSWHhPbzV3L3hLOUlVSHBtWG9IODR0VVd5bS9XZHlSMWFZc1ZDTzgzbzc3TXkxdTE3eDJLWXRqanpacnl2WlJoaFlLc213dnVZK1cxIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e08b360e-ef3a-49c5-b349-41be2a9569e3", "record_id": "flaws_cloudtrail:0000227:e08b360e-ef3a-49c5-b349-41be2a9569e3", "row_index": 227, "timestamp": "2018-10-29T02:19:35Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1055, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e08b360e-ef3a-49c5-b349-41be2a9569e3", "eventTime": "2018-10-29T02:19:35Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJLRnlpcWRZTDExbXAxNCtqbjAzbXNZdEhjSiszdGhSOVBOdXJwTUVHUVFhZFhCdW9TQURTV1pIazhMcG9EMnllRVVnUVE2MmdhMlN4eE8vRWcwejduRkEwMHJZaFZZcG03YmVPRXpJK3c0RWJORWVYRVZ5U3VTdmwvdzdLcE5RbVdtMGxNM1hFVVM4L093RitaUGRoZzYvdVMyczBqN1NWQVd0RUpxV1hwUnZTVDRtVzRkaDQyTGd6YnBQY3dsN1B0MnJYIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c7a2fe78-d35b-4a50-b6b0-ee4fbddeb861", "record_id": "flaws_cloudtrail:0000228:c7a2fe78-d35b-4a50-b6b0-ee4fbddeb861", "row_index": 228, "timestamp": "2018-10-29T02:19:38Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c7a2fe78-d35b-4a50-b6b0-ee4fbddeb861", "eventTime": "2018-10-29T02:19:38Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ1cERhNklSeUNDSGpDNVFiM0hueExtc3Bob2YvREt3aFExZUlXalhwNUE3UlQ4enNab1Y5OUtwZ3RpdUQ3clR1aEhIeFArWXY2OEJDVmlOZk9oQTcxbHRKb1hDZlkxTCtsbzBOTVk5YS9FN1BaYjl5SGZFU29JM2dXV1FUdzlLYlNtWlZvVW5qNmFBZTJEK2VpTUZsNlh4TUEyRW5rVXlya1ZFQllad2hOV3dRMlE4RmNhaG9Lb1UrMjFQN0cyVThteTNoIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e5f9b9e0-a523-48e8-b1cb-77ca7fd6314d", "record_id": "flaws_cloudtrail:0000229:e5f9b9e0-a523-48e8-b1cb-77ca7fd6314d", "row_index": 229, "timestamp": "2018-10-29T02:19:39Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e5f9b9e0-a523-48e8-b1cb-77ca7fd6314d", "eventTime": "2018-10-29T02:19:39Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJaYnQzNGlnQTFtQ2tQTjdGbi9teXNJTWx5M3gyb1JMdWxBUGE3NmVtdmhmQ0dDNUNkZXdtaXQwdC9YUnU1SVh6YUxqTGwwN0dFeitYVlZWRUdLbjcrSU1wY29EUXUraXZ2SnQ5RWN6elVPVlU3Yy83OSs1NFh0Z2hZVzI1T0JQakFKajUrWmd0eENPVHI4T3hYcHR6MGN4YXlVVVVYS2s0VVU5czNCSVpCMWVydnhHYjNTdGpkZXMzeXNQMVI0L3dFQ3ViIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1d1cb2c3-5daf-4f47-b196-6a5f8cbb0499", "record_id": "flaws_cloudtrail:0000230:1d1cb2c3-5daf-4f47-b196-6a5f8cbb0499", "row_index": 230, "timestamp": "2018-10-29T02:19:40Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1d1cb2c3-5daf-4f47-b196-6a5f8cbb0499", "eventTime": "2018-10-29T02:19:40Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJCMkUwMDFPRFlsSDVsQzNFV0J5SXB1ZEgwMTZDc3FBcE9RKzg4MzRpMmtPZVBEYTF0NXI3MU5tOTZNSWQwcnZJMThTQXlkNEJnUzNmZHR2Um5uYnJHMXpwMEErMXB3T2EyTm44NURLaWtxRG9qUWhJSlhac3lyVVdCTm14bExoZ09FZThnUk1VaHdRWmpGdVIwb0RIWFo5MkZ5eU1xd0RhVWlkS2lMeWMxQ3RxV2cyKzljajBMZHhDWlhCSkZYc0pEakV3IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1330cd01-c36a-474d-80e4-8df92dbd0fa0", "record_id": "flaws_cloudtrail:0000231:1330cd01-c36a-474d-80e4-8df92dbd0fa0", "row_index": 231, "timestamp": "2018-10-29T02:19:41Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1330cd01-c36a-474d-80e4-8df92dbd0fa0", "eventTime": "2018-10-29T02:19:41Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJZaEM3QXl0T0tFUVh1SmcwQjVFTGVIcE5oMzhRbU44RUs2ek9KY290SDFFbEZjVGh0YkNOZlBqOWZCNnBwdzlVMTh2VHBLZVd1ZGRzeVdsRmtxZ0lXVm5aRG9EWkpLeitLeUs1ZTJEUDk5dk5pbkVJcFNValNDVEpVZTlmMUszN1hNbHhwZmxzZTVkNzZDMmd3dm85cERwUXU3S2hxYWViekxKZHlCSTBXN0ZmdFV0MHNjZnc1bXQ0eGZPbkJHaDY3ZWdRIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b5dfc4fd-1112-497a-9c3c-e4791017d57a", "record_id": "flaws_cloudtrail:0000232:b5dfc4fd-1112-497a-9c3c-e4791017d57a", "row_index": 232, "timestamp": "2018-10-29T02:19:43Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1053, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b5dfc4fd-1112-497a-9c3c-e4791017d57a", "eventTime": "2018-10-29T02:19:43Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJGQ1hXZ3JhbktBSFpCaGZnc3p4MldmQWF2RG5Sb0dpV3I1K0wxWDdPMVRTQi9ZRk1zL3BmYzZhNUlac0E1YklnOVBRRlp6VFdnUVFUMzFaeTFiQ01kZ25DOFlsL2pRVFNSaU1QdjRJZFZxdkx2ejFENDlpaW45SkFmTFFZSGhTVU9ib0x5QTVNdFM0YVMwcHZjQ3ZGUUtYK3FTSXRXdFRyUHVVd21EL01pZzYwTlkzRWZYY3BYeTJyMVJPeXNTb2ROdz09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "db1e28fb-946e-4cfd-a1b8-a8c026a867679", "record_id": "flaws_cloudtrail:0000233:db1e28fb-946e-4cfd-a1b8-a8c026a867679", "row_index": 233, "timestamp": "2018-10-29T02:19:44Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1056, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "db1e28fb-946e-4cfd-a1b8-a8c026a867679", "eventTime": "2018-10-29T02:19:44Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ6OEovMGFxQm93Q1g2K2t4WmNRMlVlMGdWUXVBWHMybTJlZGVZYUk4OVFqeTMranNMOXlhSURPd3FRaTllUitQUXNQa3VaaTRjZi91VlMyN0lOVmhaRERrckVjUTV2aUgwRHRCYVk2WEtxbXEwNGJZcFJMazhnSVYvWkczWHFkUE5vRFowekRudytCZlZIK202b0FPbWxpNjZzWmVEbTRTSzBZb2FnbmwzMkFnajlsbW1tR1NwcFFOYkVnd0gwV0tYQT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e327187-28b3-4d80-b2c8-4c5fa9b0fbc5", "record_id": "flaws_cloudtrail:0000234:e327187-28b3-4d80-b2c8-4c5fa9b0fbc5", "row_index": 234, "timestamp": "2018-10-29T02:19:45Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1053, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e327187-28b3-4d80-b2c8-4c5fa9b0fbc5", "eventTime": "2018-10-29T02:19:45Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiIxYUo4enh3ZDFWQUJsUUN5YkJNR1o3QURjelBmUHlIdVplckdOMWJHQ1Fnb3FJRHZ6ZlZxOTU5SldZWDl0aU5UUStnblYxYWRVMVpaaW9XWFdlYy9mSnR4NGdndVJ1MU0wa3g4aXIrN3QzOEh5cmR2SVArME1xdjIxTnpKS3o0eU4vcmpjQUgxRCtqazNxd01TUjUwK21reU03ZkYrWjRad0tOekR1QVdCQ3RBTzBPc3hvWUwrbm5Ec0pGU0Y3cllYV2xkIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a8ce60a9-837a-4adb-9e47-eb406238bc91", "record_id": "flaws_cloudtrail:0000235:a8ce60a9-837a-4adb-9e47-eb406238bc91", "row_index": 235, "timestamp": "2018-10-29T02:19:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1054, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a8ce60a9-837a-4adb-9e47-eb406238bc91", "eventTime": "2018-10-29T02:19:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJhaU5mcXhtdnhlanZoR283R2p5NFBCdUVZWDZYcUNvbzdHbS9jeWZYU1NaUnY3a2F6UXJVVWkrOXFyMElhS0xOM0cvc21FYzJLY0JxdThUazNZam1qZUdoaVN1emZkY2NzUlRWeGp5U0tJd2ZuY1VNM2ZvMjk3ZmR0Tk53dmxvUlZtWmpjUEV5SUZha1dHZmJOemM1Q1N1anZ3UmtsOWU5eTV0Y0l4QTd2Smp3elNiTmFhMUFjZ0R5RWdpdFgzNFpNN3crIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8780fc9c-8aa1-4d2b-a299-ca1cca87f687", "record_id": "flaws_cloudtrail:0000236:8780fc9c-8aa1-4d2b-a299-ca1cca87f687", "row_index": 236, "timestamp": "2018-10-29T02:19:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1078, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8780fc9c-8aa1-4d2b-a299-ca1cca87f687", "eventTime": "2018-10-29T02:19:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJLNExpWXY0ZDQxVlFDZ3l0cGNxUnc3aXZUWUtEbVIwUmEyd283MnVac3hKZWpOcnhPMzFIZzFVMzNsLzE1RmZZazJ5RVlHTGlGZm1HeWc2REQzekV6UUVJakVXWVJ2L3o0dHBIWTFaa1NFOGZ1bERVMUFDdEpCN05aNTBxV215cjZTeFlnaUZHTjJlWFFnRXkvOUNnRWNGbllSYmJvV3BpeEppMzg2dEduNFZLN29HUmhRUVNRcUJ0ODFaTXdwTklUeFV2OTBMOEFvdzJ3TkFBSFFQU1JBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2bd416e9-6726-4bf4-af7d-951685c15abf", "record_id": "flaws_cloudtrail:0000237:2bd416e9-6726-4bf4-af7d-951685c15abf", "row_index": 237, "timestamp": "2018-10-29T02:19:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1078, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2bd416e9-6726-4bf4-af7d-951685c15abf", "eventTime": "2018-10-29T02:19:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJFTkJaVm5ZdVZzVC9JTjhCTzBTNTliMjZmZWd4TjE2NXlyeHRLYng4cmpFekhnQ3lVeUVWcEl2VitQZENhT1IvbXkxaG1jdzJKY3JKY2NJTTFic3Jrd2ZyMFBFbHJRRDlNVkZURlBJaFdqVEJzVUtQamFTWEVJVXlyZzdXRFZjNUgwWTlaUUpJN01RV2NTVDNHb09VNndCeFNhOWIzSzdIZjUybDVuWTFyVkVmRTUyclBZanMwWmJZTk0zMXpOQkJGdEF4U2E3L2xwV3VhZUF6Y1ZUWmVnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1cc8b478-78fa-43cf-9be9-88b62245e42d", "record_id": "flaws_cloudtrail:0000238:1cc8b478-78fa-43cf-9be9-88b62245e42d", "row_index": 238, "timestamp": "2018-10-29T02:19:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1028, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1cc8b478-78fa-43cf-9be9-88b62245e42d", "eventTime": "2018-10-29T02:19:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJWakdQYk4yWWNTR0s4V0Rqem9nNW40S3E1d3Y0S0xCbmRaT2dzaEtMalNzUmZ5Y29SUUliMXdPS0lVZm9DM1ZrNTkrMmpZTFg5UTJNN3BjRXI2RUxucDNlMHZNTE5tVXp4eHg3RGt1OUpFUVpnTEh5d0c5dHlTblNzSWQySjdtelJJUFF0TEtyVVZOMzkwYnZ3Q3JkNno5N00xdS9MSUZYVisybEwreEk0VXkxb05NNkVMTzMiLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f4f61479-d5e5-456d-ae59-0294efbad5f0", "record_id": "flaws_cloudtrail:0000239:f4f61479-d5e5-456d-ae59-0294efbad5f0", "row_index": 239, "timestamp": "2018-10-29T02:19:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1078, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f4f61479-d5e5-456d-ae59-0294efbad5f0", "eventTime": "2018-10-29T02:19:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJUR0ZlSkIxdzlLUkdCL0JzaGhXcVZUb04yT28waWNicjJSZTJuN21vUndnWUZZV05HeE5ERHlFNVBsd1ZQNUU1YmFoSVdwKzNFQnllenBTQnRrMEFKL0lOc2M1RUk3ajNPcGtGS1lOYlFYWmVTcUQyWUl3eFhBWlZ1Y3lrMTZ0UGhkZlJFaUhsc2VsUkc3MFlRMW0zdkNoMC82cUJpUENHeFRlNFNDVFpPaDJRbXpQVzRXdmlVNDg4N2hkTHhBTVcwK291L1lZRG1peUZySUhpc1BJUkJ3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a2ee1308-e2c3-4c4f-aed3-b107b656e7d4", "record_id": "flaws_cloudtrail:0000240:a2ee1308-e2c3-4c4f-aed3-b107b656e7d4", "row_index": 240, "timestamp": "2018-10-29T02:19:47Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1078, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a2ee1308-e2c3-4c4f-aed3-b107b656e7d4", "eventTime": "2018-10-29T02:19:47Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJsanBiNDBhQUJKY2xqZXg1UW9qbkdTdStUYlhsdXpRUDdQZ1RSUThaODNjbXBWb0NyWUhkdzBVS3hma1dJS0xwN3hrRU5HQTA0R2w2cG5xdVB2NU9iOXVySnpGYWJhbzA3eWl0VU1FdSs3MXMwSG85TUpDVEYyRmw4aFdQRDEwSzdnVUU3cUFqM1lhT1BzNlJSM1FZTWxMeDh4Mjh2TWJRbnRSWmdhbkN1Z0tCL0ZCdWVpckZOQ3lZODc0KzlPRG9qc0ZqTVp4U2hVS05VSjQzS0FSTEZRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "12c6d9ba-82e4-421b-9d16-098495c87221", "record_id": "flaws_cloudtrail:0000241:12c6d9ba-82e4-421b-9d16-098495c87221", "row_index": 241, "timestamp": "2018-10-29T02:19:48Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1079, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "12c6d9ba-82e4-421b-9d16-098495c87221", "eventTime": "2018-10-29T02:19:48Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJxKzlvTDhUNU5lUllYSzhWZ1F1TFFXejZXbGlnZGZVOHZvV2V5cGl2bUFkcDVPYmlhUmtBTFFLeVNyUzZZTHIvV1ZvY1I0STlid1ZROEpOb1IzaXhMcklaMzNEUGMxNGNiZnRpaHg1SkpTbDVxRE1wbDVWYkpnTS9oYWtMbkFmbUJSR2czeUY1elZzM083Q0ZjeDRIQmQ3ZTR2b25wZ2Njd0tFYSs4ZW1jSXJaRFpzc0FOb2loNC9ZVmJIZm9WTG5BOGp2WXd1Tm1JYktMeWdESGtRZmNRPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f542f9f1-e914-4cc1-8048-8585fa9cdd76", "record_id": "flaws_cloudtrail:0000242:f542f9f1-e914-4cc1-8048-8585fa9cdd76", "row_index": 242, "timestamp": "2018-10-29T02:19:48Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1078, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f542f9f1-e914-4cc1-8048-8585fa9cdd76", "eventTime": "2018-10-29T02:19:48Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJHRlhMN1FHTTMrNTFSc1h1ZzIyUkpNa1FCOXdlQ1YwM0swaWhKVTV1bHBsQXZnZXoxWjJIMzhtNk1SOHEyNXNPaWpYMlpKWGxvME9NUit1dDVaU3hQRVhnc0FtQ08rQ2dXZHAybjArL2xOZ3NYVlpDQjl1UFlaMk12UUhzYnducG5CeG1VSERpeXM4WWpPeWQ0VTRZTjF0QXNOSlRVN1BmK20xOGJuQXRnbUVJd3dQN21vQm1TQi9QQXJOSnZRb3MxU0o2Vmk0WXMvdmtwbC9IUys5MStBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9cde5188-3807-46b5-b5a9-a0f2a302ac19", "record_id": "flaws_cloudtrail:0000243:9cde5188-3807-46b5-b5a9-a0f2a302ac19", "row_index": 243, "timestamp": "2018-10-29T02:19:48Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1078, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9cde5188-3807-46b5-b5a9-a0f2a302ac19", "eventTime": "2018-10-29T02:19:48Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJHMEdBaDFOYVFnSGdGY21YNk9OTFpJa1V1Um9nR2hhK3BFUjJPb0wveTlrK0M5Unpja1ErYmZPbFlnZEd5TkYwTUNSckpQNDRUUVhGRTlRbktPeTZNTkpvcTU2OWEwbkNmcEI4aTJSTms2UURvYmx4d1V6M3B1elV6QU1ZNWJvNkJUb3lYVWdYUVNIN3B3MU9ObExkWklCdU9iMGYxL0Zsakx1UlVFenRybEJXWUd6OGNaemRlaTFFb25SR3FsMGs3UU80ajlZU3ZBelhoL1RwRjF4UCtnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ef345019e-a266-404e-9dc0-354ec68070bd", "record_id": "flaws_cloudtrail:0000244:ef345019e-a266-404e-9dc0-354ec68070bd", "row_index": 244, "timestamp": "2018-10-29T02:19:54Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 765, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ef345019e-a266-404e-9dc0-354ec68070bd", "eventTime": "2018-10-29T02:19:54Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9a7205d4-3131-4269-95fd-1797e393b8fc", "record_id": "flaws_cloudtrail:0000245:9a7205d4-3131-4269-95fd-1797e393b8fc", "row_index": 245, "timestamp": "2018-10-29T02:19:55Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1075, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9a7205d4-3131-4269-95fd-1797e393b8fc", "eventTime": "2018-10-29T02:19:55Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJEeVQ0YXp4d3o3eklua2JVSFNFNzYxTk5RQSt0Snl4U3ZiNUZOL1RaVjZ2L01PNXR5MHlwQ090byt4eDdRVHBsYUpmWnJVdXNBUXo3Ly8rYzNTSTczdDBZQWY2Ymlla0FEMzkxOS90TWRaSERXRUwwUzFlMVNOdFdMeDc0K01ua2p2Szg4T2VGdUtwUnlDMXlOMmVBV3dxa3k0Ujd2bmNNWHJkZnFkcWtKVVUxRWhSZ3liZDVIL2VVWWlMT2RFOTdGWjFXIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d0025fca-152a-41a7-823e-4ca2f091ee4d", "record_id": "flaws_cloudtrail:0000246:d0025fca-152a-41a7-823e-4ca2f091ee4d", "row_index": 246, "timestamp": "2018-10-29T02:19:56Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1076, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d0025fca-152a-41a7-823e-4ca2f091ee4d", "eventTime": "2018-10-29T02:19:56Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJFL20wVG9BUVBWMmhPQ0c3ZVIzcGR5NTd5T2JwZmNwYmFuTmpmMjZPMzkvMy8wRHQvNURxN1N4aUZBV1BHMmYxT3R4YXdYSzFsWVhIZ2VYKytBOGNscTZ0NTBBRXRqMWc2Qlc0TCttTFhieklOMzQxcjlKaFY1SC9WOFk1dlhwZFlqV25ESmJYZEtGTkhxQnM2Z2ZJL3pBaFBackxXWFpRbFVWTWlIWHFOUTNyS2dNOWQyS0FOQzR4UithYi90Qm9OdEgrIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "178127-3c64-44db-ba28-9f578cdb3fa7", "record_id": "flaws_cloudtrail:0000247:178127-3c64-44db-ba28-9f578cdb3fa7", "row_index": 247, "timestamp": "2018-10-29T02:19:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "178127-3c64-44db-ba28-9f578cdb3fa7", "eventTime": "2018-10-29T02:19:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJIS1N3ZHNqRytBNXozMEI1WlFrdjNDbXRQODdFU25QbGt5M3A4NkJWZkwxeUpBM2hSRjI2QUdySnpYWmNDODlGMmtiRnpiSHl6VVFJaFgySHRaU1ZzdEhMVnhkNFQ3M0hrK2U2WExhY3BhQjdlQ2ZFdG5kZmhYSWFvTnhFcHJEWDJvM2dKSmVWQzNXRmtPanlSYWJERHhyL1RSbm1JN3lYUnFSZWVzNUxtbUVjWEtYSHk0YThyNzdCTm02WDVxK3ZLWUtJIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "aa22a0c0-6260-49d5-974c-3ab19db0339e", "record_id": "flaws_cloudtrail:0000248:aa22a0c0-6260-49d5-974c-3ab19db0339e", "row_index": 248, "timestamp": "2018-10-29T02:19:59Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1075, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "aa22a0c0-6260-49d5-974c-3ab19db0339e", "eventTime": "2018-10-29T02:19:59Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJhbndpdm9Mb0J3cmNIYVJhQXo1RjJTc2NrUk1GaHErSndRZFNQR0ZteUxXYWo5d2xRb3FHbDZFdGJ3Nk5tTXdCMkxlNWVmTGhsNWJkZGJIS2FJVnBkQ1kyQVJhMCtmSkwrd0hyVGVvUFBuWEdyS2FFYUlmbTF6ZXRPemZEbjljd1piK0xDQ3JQODdOaXNkVHFyU1BWakFuN21RR21FemYyeGUwNDlvT3NsNm5acEhyNnpWVWpSdDVLbE9mcERJV1kvVU5mIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "51e1b445-9704-4629-be9d-fae2ccbf0c2f", "record_id": "flaws_cloudtrail:0000249:51e1b445-9704-4629-be9d-fae2ccbf0c2f", "row_index": 249, "timestamp": "2018-10-29T02:20:01Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1074, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "51e1b445-9704-4629-be9d-fae2ccbf0c2f", "eventTime": "2018-10-29T02:20:01Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJGUnlMSkZMS1I5RWxVdnFxQXpKT2s5NFI2UVMrTlY5NXRKd0ZCajlHQUpWcVArdHVDd2N6MkJES3hySkdOcjQ1QjkvZzNiQWFhVHZ0MWcrTlp6TnhGV3M3Rm45dm5aNjJFTXlCMnBkNGdOc2s3ZjFuZjhYNVJzSG9RV3M0WXQwanphc001M0VHZWErY2h3Q2JTaFFMWktYQjlxdG00TElhNXA0eEp5empwdzZXK25Oby94Y3drZzFuNFFIUm00RzZvVGZ0IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "024832-ad4a-4e62-9773-358146d82522", "record_id": "flaws_cloudtrail:0000250:024832-ad4a-4e62-9773-358146d82522", "row_index": 250, "timestamp": "2018-10-29T02:20:02Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "024832-ad4a-4e62-9773-358146d82522", "eventTime": "2018-10-29T02:20:02Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJZRGIzOHV4THRYOUNCcVduUHhKenFLck8xcTZSdk1IemFzcDF3dGlETU9mdXpLNG5sRFMxUnV4QkhvVTArcGlnYnNsaFZlMXduNW1QZVMrVkN3L1pzNG91akp2SlFGU1B2WWdLbVhBUEZpZEtKOWNnWDd2Y090MTQyQjJUeXZGMHhZK1FGOVNtT1gzU2FhQ1pVeFp1azU4UzY1eGFOQjhFakZ5WXo2R3NXMjY5UHFGbDRqR2tzT2dndEM4MnJldFQ2K1diIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a460ffff-f5ec-4f1c-a8c4-926fd6a5727e", "record_id": "flaws_cloudtrail:0000251:a460ffff-f5ec-4f1c-a8c4-926fd6a5727e", "row_index": 251, "timestamp": "2018-10-29T02:20:02Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAD60J9SMN9M772UW9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "74.178.214.222", "user_agent": "aws-sdk-java/1.11.879 Linux/4.14.225-169.362.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/25.275-b01", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:iam::811596193553:role/data-reader-67"], "raw_record_size_bytes": 720, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a460ffff-f5ec-4f1c-a8c4-926fd6a5727e", "eventTime": "2018-10-29T02:20:02Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "74.178.214.222", "userAgent": "aws-sdk-java/1.11.879 Linux/4.14.225-169.362.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/25.275-b01", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAD60J9SMN9M772UW9", "userName": "backup"}, "requestParameters": {"roleArn": "arn:aws:iam::811596193553:role/data-reader-67", "roleSessionName": "reader-8229"}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/data-reader-67"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "448745e-a376-4755-88b4-fb885ae8efef", "record_id": "flaws_cloudtrail:0000252:448745e-a376-4755-88b4-fb885ae8efef", "row_index": 252, "timestamp": "2018-10-29T02:20:04Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1074, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "448745e-a376-4755-88b4-fb885ae8efef", "eventTime": "2018-10-29T02:20:04Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI1M0Rybkdza0d4VUV6eTNQTmhBMlo4Z2pWcEJpenFFQ2paYUQ5MFJoeU1yUzNaLzRNRzFYcndlZG53QTlsdk1BQU9McTM1dk9GNlp0akVjQUVJc2J2a2xDb2NmNzdMY2pUaXZnSE9BWXF5TjkxWkNVREx4Z3Q1TmNlTnFLaXlrcyt1Q3RQZUt4cnVNb3JQZFRBOUN4eGF1aHhHcXZLVWdSbFN0Vkcxc1FNcFBwWVlyTzdodHdwSm5ZcytXT3gvenhabEp1IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f157513d-09f8-4dac-8383-3fd545e1fdd7", "record_id": "flaws_cloudtrail:0000253:f157513d-09f8-4dac-8383-3fd545e1fdd7", "row_index": 253, "timestamp": "2018-10-29T02:20:06Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1075, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f157513d-09f8-4dac-8383-3fd545e1fdd7", "eventTime": "2018-10-29T02:20:06Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ3NGhWYTFzbUpDS2NkeEJVOHdHRk50Q3doR1U2YmxBR0VoUjI3Z0FmZjZuRjIzNU1qcVY0Q21jMjNXVHBGKzhmZElrak5aSkpIejhzeWsvSkM1TnpuVFVIT1R1WkprWkdyTXFUd0c0Tkk3aEppd29sMXlMUGpqT2ltdkxtcHFtYU8xbHNiZlgrK1daQ0pXTUtKdHFrMmtqNU52bzlPWkNxR00xL3Z6WWZtL0NycU5oYWluSFkrZFczcTBabDUvQzEwRVlRIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf51f558-63a5-4363-8252-1b09f0a687148", "record_id": "flaws_cloudtrail:0000254:bf51f558-63a5-4363-8252-1b09f0a687148", "row_index": 254, "timestamp": "2018-10-29T02:20:07Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1076, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf51f558-63a5-4363-8252-1b09f0a687148", "eventTime": "2018-10-29T02:20:07Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJUNEpmVUlVSHlyNittUFJlMHZBKzMzR3pNRjRXbEtmUEc4aXZPbU11NTh4V3RZWk84Rk12VWNWZkNKVXBMeUM5bmlEaUZWcklsRFdSYmM5YThWUnZwb21kWGZhTXlxenRRdVJFdGFSVi9hT2puMjE1VW0zNXN5WGw5cG1ObXdSOGdkT3NjZ3lVM1MrRzgzcDU2VUJxMkdsYVo4bkl2aVVzRXNXZEpnbGFoMUJnOVg0YlliL0lGOGJuTEQyNG1EU3luUT09IiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6d7619ed-f808-4b49-ae38-8143aa25bfff", "record_id": "flaws_cloudtrail:0000255:6d7619ed-f808-4b49-ae38-8143aa25bfff", "row_index": 255, "timestamp": "2018-10-29T02:20:09Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1075, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6d7619ed-f808-4b49-ae38-8143aa25bfff", "eventTime": "2018-10-29T02:20:09Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJJVVZlODVWVGNsTVFaM2ZRVm1VV2VuK3B1SXR2ajhZNldvNnpPTFRyMUVYU0NMRDZkbHd4RktOcW11bis0MTg3end3Mnd6Wk1tU0tHWHZybFd3Ziszd2FCK2dSeGh3b1ZHT1h5TjlOMzBrQlJuTitscEp6bVV2Ump6Ym1IeERyQ1RwQTl4bDAvdGF5SDg5SmwyRFp2QURlMmZLc3B3NWJXbk1KSTlVQWh4NWVxdnEwRS9aREVNMEZtenZId1ZtcHNjbm1VIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "911966e-7691-48d6-a382-522192ad08d34", "record_id": "flaws_cloudtrail:0000256:911966e-7691-48d6-a382-522192ad08d34", "row_index": 256, "timestamp": "2018-10-29T02:20:10Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1075, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "911966e-7691-48d6-a382-522192ad08d34", "eventTime": "2018-10-29T02:20:10Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJzY1JjTFMxd0RTWVJHRjU2WUFCbUxCY2ZkeE5oMjVmOUNReXp4MWRXUU9zbnFzODdDaHZKR09YeWdkeTE5MlQ4K29Zc0Q1VEFJU1RmeDNaUmxmcElpYUYwMzQvZ1luMGg5b29ZU2M0V2hiR2NOOGlxNEd4amZvcWNUUzZVWUl6eWNBNGMwZG1kTEU1MmxYLzhjZmFreGxlQU9LU3JCZ3Q5bnVKTUVJZ1ZHeWFDVTFJZDJpWURkTjNPV2RhQTFlK2YzZ0dxIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "03182b-6c8f-425c-879e-130675fa27f8", "record_id": "flaws_cloudtrail:0000257:03182b-6c8f-425c-879e-130675fa27f8", "row_index": 257, "timestamp": "2018-10-29T02:20:12Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1073, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "03182b-6c8f-425c-879e-130675fa27f8", "eventTime": "2018-10-29T02:20:12Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI5YVc5a0wrVmpRT1lIcDRGVEI4MkJ0TURjS3d1am0rRTF1dFBqajhQL3E1cXlBZ0V3Z0x6R1kzOHBOV1l3UDFLby9JbEdkNE8zbnZBeDJiOFRSdFNTNkxGZFNNZGNRVmpsdUlHai9wWXhBVmt0cjhBeC9MTFI2dkRkSk56azhHWnU1MlRkanB6Y3lvUVN4QzE3RE9iaVVxRXhzRWdrMndvMlA3K1ZIVS9hMDFiT28yOU82bnU4NUF5azdtQzRBNTRnSWVYIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e438439-a151-4e6e-9855-4beceb2f6ce2", "record_id": "flaws_cloudtrail:0000258:e438439-a151-4e6e-9855-4beceb2f6ce2", "row_index": 258, "timestamp": "2018-10-29T02:20:13Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1074, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e438439-a151-4e6e-9855-4beceb2f6ce2", "eventTime": "2018-10-29T02:20:13Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJaVHJkc1Z5dE5rZmNEZWZTZHVqVTRCWTV0Tnp5WWcyWHRYMTVZV29Za3dSZ2hVNDZHeFFCZldZK05TNlhhaURndG91T1U1TVhDT28vbmVNUG9QRUtoVk8xNmpiRG1zMS9jbXB2UWRORDcwdEgyYUdFcmh5NWV3Z1VXUFRDSmVoTVVHaC9TczhKdTZpdklnSklkaUVNV3dNNXJjMC9SL0NRek10Zkx0NHFBMENvVWR5TGExampkNkxVMUlaTStwSFBUKzBtIiwicyI6IjEifQ==", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c62a172-9014-4714-ba64-5724f87d4c7e", "record_id": "flaws_cloudtrail:0000259:8c62a172-9014-4714-ba64-5724f87d4c7e", "row_index": 259, "timestamp": "2018-10-29T02:20:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1097, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c62a172-9014-4714-ba64-5724f87d4c7e", "eventTime": "2018-10-29T02:20:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ3NEVGOVo5Ym1oUUcxTWZodklJL0x0c0tvL3A0cG5GTFhweHVmVlRtck1iVUNHODdUVTV0L3FjY20wKzY0MVZpRmd0TUpBTVI5S1llVEJ0MjF3SWdBYUF6bHRzMStpaVdyOHVlYURoNCt5d3NVNXhVQ2JtZzdlQTRSQ0VtWWdGaDgvQVN0TGFxM21NTnZRWXBXT2FEK2swYTU2aWxlT1N3YlNVaDBlNDVhbEU4a0VNaFlXSWtjdm9yU3ZqbmE3TGtmT1d0dFJUYlU3eGIzbkFvaFN1ZTNnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "38ae9d32-4a5a-499a-9273-3c38d6db9a0d", "record_id": "flaws_cloudtrail:0000260:38ae9d32-4a5a-499a-9273-3c38d6db9a0d", "row_index": 260, "timestamp": "2018-10-29T02:20:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1097, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "38ae9d32-4a5a-499a-9273-3c38d6db9a0d", "eventTime": "2018-10-29T02:20:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJGem92dzFrSHJ6WGc5UzNSSHNqNS93dEY0U1Y0MS82cjVsRTZMeFllSkFkNUMvVEhuRU5teHl5MTd6MEJRWFppR0d3a0JCcFdmbFk3VjM5WlFNZXo0dVBTcDJsdm13UDZXQzdUTlN6bXhEa0xGNk1pYTQvZm00d09XUlFWTVhhTWY0amVSQXZWaHRHUngzVjc3cjhIWjhQUHliTVI0VlZ0ZkVsTDVDNXpVSEhPK2YxWG16Y3pLWlpWQktkcTYvR0xlQVdreHkvM2xwUkdxUUNhTHB1RFV3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "801308e-813a-4876-afc9-3efdfe841afc", "record_id": "flaws_cloudtrail:0000261:801308e-813a-4876-afc9-3efdfe841afc", "row_index": 261, "timestamp": "2018-10-29T02:20:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1098, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "801308e-813a-4876-afc9-3efdfe841afc", "eventTime": "2018-10-29T02:20:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ5UUU5b0ZURUxwV3lKMzBMeWdkQ1V1d2FTTHB3cGsxK3kzdDVTRkwrU0xrcEJBbVZ1dzNCd3YzSm9BYVJmeXJqclN6RVpPeGYxZkhPWnFXNVZBL1FLdUxzemtHYnJUVXZ4MVpZY3lyeCtFM2NhZWxKNUNocmVndElpNW96V3hQREwydTBJeW9VajRUNXZkNVZFZFp0VSs2cUZjQkRXUjA3SFY4Z3hzVnBPZzU4eXFtcGZhaFNOOExmdDJUbVVWUVBneTFqb09aUkY2WTdnODFaUDhyNFJnPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e62b706c-dab2-4e71-9bf2-98e3a089e022", "record_id": "flaws_cloudtrail:0000262:e62b706c-dab2-4e71-9bf2-98e3a089e022", "row_index": 262, "timestamp": "2018-10-29T02:20:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1099, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e62b706c-dab2-4e71-9bf2-98e3a089e022", "eventTime": "2018-10-29T02:20:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJtL0wvSDlydEJXRGtOOEFWUFZEY1RiQi9ITk1OWUtMdVZHeUdJaG9HMWZTUWtlZ2xWVE9ZQjFURE1lQkUyMnpJblNyZkxJREJmNlZmeGpaQnltZndCeW1xRDFtcXU4cGRzQjBhS3JONVpHZ002RU51WFU0RGNjQmRsMzBYd25ReFBVcTI4QmFVcThQWWNvMGFKOWpwbDI3UEpNVTI1cDdTR0FTelczaGhhalJGbGN5bGU3STFsKzd5ejc1YTRFTzdXMjJLbGQzSE5Qc2NBeHdrOWlzM1d3PT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "388f0252-394d-47d3-8945-66bf18409f", "record_id": "flaws_cloudtrail:0000263:388f0252-394d-47d3-8945-66bf18409f", "row_index": 263, "timestamp": "2018-10-29T02:20:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1065, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "388f0252-394d-47d3-8945-66bf18409f", "eventTime": "2018-10-29T02:20:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiI5SUw4QkpPcUswNUxOek82NW1xL0lGbitwMFpuSXZpTUlEaXJzb3VKdFdhRTlnYllqZEpoeUlXOENrQUU4SDdUN2VTQno2MG53R2xKanBOcnVUR1pCYnQ1VmhLRkk0OFY3Uy9LMnJZczM1T2JwODBJOG9QcTZBNmdHeDN5UGNxcTNBdStkZUZxQ1pHMFRWOG9mUW5zQ3hFay9ZdWRrZXlnWHo2RFZwUjNDNjJYTFVtZ0hOQVlpZlZNMGw2VU85N2MiLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4de439063-e86a-4fa8-8728-a5ea471979", "record_id": "flaws_cloudtrail:0000264:4de439063-e86a-4fa8-8728-a5ea471979", "row_index": 264, "timestamp": "2018-10-29T02:20:14Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1100, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4de439063-e86a-4fa8-8728-a5ea471979", "eventTime": "2018-10-29T02:20:14Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"nextToken": "eyJ2IjoiMiIsImMiOiJ2NkUvQk1xTmQwK2FkZVRKY0dLOGdBbDNLSGJkZlZid0JIVXJJK1dkOE1LZFVNcWppS25Xck9tVVhmVzZ6d2ZabGMvR2tRbytCa1NWRTNOWjlWTDNmRGpNbkVSeDFKdW5oUUkySXFSWnliN2Vzb0xzZHlKSC9MdWd1ano2QUt5VUxMZzFvYXZUajZpVTdHRnB2RWVvanJuZHg3aUtGMEs0S3hwUDZhV0tHYmF5QWtzNlF0K0IxUlczbGdhbGIzbmp2V25BQVp4RFpvbUtFVkNYc29tZXFBPT0iLCJzIjoiMSJ9", "maxResults": 1000, "snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "30afeb03-9dc9-4c0e-9da8-d6d8e08c93c4", "record_id": "flaws_cloudtrail:0000265:30afeb03-9dc9-4c0e-9da8-d6d8e08c93c4", "row_index": 265, "timestamp": "2018-10-29T02:20:17Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 777, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "30afeb03-9dc9-4c0e-9da8-d6d8e08c93c4", "eventTime": "2018-10-29T02:20:17Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "af572acf-7d77-47d7-8a20-9f1e255551b", "record_id": "flaws_cloudtrail:0000266:af572acf-7d77-47d7-8a20-9f1e255551b", "row_index": 266, "timestamp": "2018-10-29T02:21:03Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 797, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "af572acf-7d77-47d7-8a20-9f1e255551b", "eventTime": "2018-10-29T02:21:03Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a02b999a-a4b8-414a-9121-7965054c856b", "record_id": "flaws_cloudtrail:0000267:a02b999a-a4b8-414a-9121-7965054c856b", "row_index": 267, "timestamp": "2018-10-29T02:21:27Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAD60J9SMN9M772UW9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "74.178.214.222", "user_agent": "aws-sdk-java/1.11.879 Linux/4.14.225-169.362.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/25.275-b01", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 538, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a02b999a-a4b8-414a-9121-7965054c856b", "eventTime": "2018-10-29T02:21:27Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "74.178.214.222", "userAgent": "aws-sdk-java/1.11.879 Linux/4.14.225-169.362.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/25.275-b01", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAD60J9SMN9M772UW9", "userName": "backup"}}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9b7e9857-bf88-4f15-93f9-4d6f19c7d9e6", "record_id": "flaws_cloudtrail:0000268:9b7e9857-bf88-4f15-93f9-4d6f19c7d9e6", "row_index": 268, "timestamp": "2018-10-29T02:22:58Z", "event_type": "GetBucketAcl", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAD60J9SMN9M772UW9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "74.178.214.222", "user_agent": "aws-sdk-java/1.11.879 Linux/4.14.225-169.362.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/25.275-b01", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:s3:::prod-data-2872"], "raw_record_size_bytes": 643, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9b7e9857-bf88-4f15-93f9-4d6f19c7d9e6", "eventTime": "2018-10-29T02:22:58Z", "eventName": "GetBucketAcl", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "74.178.214.222", "userAgent": "aws-sdk-java/1.11.879 Linux/4.14.225-169.362.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/25.275-b01", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAD60J9SMN9M772UW9", "userName": "backup"}, "requestParameters": {"bucketName": "prod-data-2872"}, "resources": [{"ARN": "arn:aws:s3:::prod-data-2872"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b09d65ce-c20f-4160-8154-d5634cfdde8d", "record_id": "flaws_cloudtrail:0000269:b09d65ce-c20f-4160-8154-d5634cfdde8d", "row_index": 269, "timestamp": "2018-10-29T02:23:32Z", "event_type": "GetBucketAcl", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAD60J9SMN9M772UW9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "74.178.214.222", "user_agent": "aws-sdk-java/1.11.879 Linux/4.14.225-169.362.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/25.275-b01", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:s3:::prod-data-2872-archive"], "raw_record_size_bytes": 659, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b09d65ce-c20f-4160-8154-d5634cfdde8d", "eventTime": "2018-10-29T02:23:32Z", "eventName": "GetBucketAcl", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "74.178.214.222", "userAgent": "aws-sdk-java/1.11.879 Linux/4.14.225-169.362.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/25.275-b01", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAD60J9SMN9M772UW9", "userName": "backup"}, "requestParameters": {"bucketName": "prod-data-2872-archive"}, "resources": [{"ARN": "arn:aws:s3:::prod-data-2872-archive"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6aef372e-a6ea-4716-9f52-c9cd648f8978", "record_id": "flaws_cloudtrail:0000270:6aef372e-a6ea-4716-9f52-c9cd648f8978", "row_index": 270, "timestamp": "2018-10-29T02:24:50Z", "event_type": "ListObjects", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAD60J9SMN9M772UW9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "74.178.214.222", "user_agent": "aws-sdk-java/1.11.879 Linux/4.14.225-169.362.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/25.275-b01", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:s3:::prod-data-2872"], "raw_record_size_bytes": 663, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6aef372e-a6ea-4716-9f52-c9cd648f8978", "eventTime": "2018-10-29T02:24:50Z", "eventName": "ListObjects", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "74.178.214.222", "userAgent": "aws-sdk-java/1.11.879 Linux/4.14.225-169.362.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/25.275-b01", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAD60J9SMN9M772UW9", "userName": "backup"}, "requestParameters": {"bucketName": "prod-data-2872", "prefix": "customer/"}, "resources": [{"ARN": "arn:aws:s3:::prod-data-2872"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c8879553-dc5b-473a-861c-058cb2d8c40b", "record_id": "flaws_cloudtrail:0000271:c8879553-dc5b-473a-861c-058cb2d8c40b", "row_index": 271, "timestamp": "2018-10-29T02:27:51Z", "event_type": "GetObject", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAD60J9SMN9M772UW9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "74.178.214.222", "user_agent": "aws-sdk-java/1.11.879 Linux/4.14.225-169.362.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/25.275-b01", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:s3:::prod-data-2872"], "raw_record_size_bytes": 668, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c8879553-dc5b-473a-861c-058cb2d8c40b", "eventTime": "2018-10-29T02:27:51Z", "eventName": "GetObject", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "74.178.214.222", "userAgent": "aws-sdk-java/1.11.879 Linux/4.14.225-169.362.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/25.275-b01", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAD60J9SMN9M772UW9", "userName": "backup"}, "requestParameters": {"bucketName": "prod-data-2872", "key": "customer/07271.json"}, "resources": [{"ARN": "arn:aws:s3:::prod-data-2872"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cb0c2551-b465-40a1-b4c6-313e6a97440a", "record_id": "flaws_cloudtrail:0000272:cb0c2551-b465-40a1-b4c6-313e6a97440a", "row_index": 272, "timestamp": "2018-10-29T02:28:46Z", "event_type": "GetObject", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAD60J9SMN9M772UW9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "74.178.214.222", "user_agent": "aws-sdk-java/1.11.879 Linux/4.14.225-169.362.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/25.275-b01", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:s3:::prod-data-2872"], "raw_record_size_bytes": 668, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cb0c2551-b465-40a1-b4c6-313e6a97440a", "eventTime": "2018-10-29T02:28:46Z", "eventName": "GetObject", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "74.178.214.222", "userAgent": "aws-sdk-java/1.11.879 Linux/4.14.225-169.362.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/25.275-b01", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAD60J9SMN9M772UW9", "userName": "backup"}, "requestParameters": {"bucketName": "prod-data-2872", "key": "customer/03841.json"}, "resources": [{"ARN": "arn:aws:s3:::prod-data-2872"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a70654a7-83cb-403b-b77e-7636814a5b8a", "record_id": "flaws_cloudtrail:0000273:a70654a7-83cb-403b-b77e-7636814a5b8a", "row_index": 273, "timestamp": "2018-10-29T02:29:11Z", "event_type": "GetObject", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAD60J9SMN9M772UW9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "74.178.214.222", "user_agent": "aws-sdk-java/1.11.879 Linux/4.14.225-169.362.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/25.275-b01", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:s3:::prod-data-2872"], "raw_record_size_bytes": 668, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a70654a7-83cb-403b-b77e-7636814a5b8a", "eventTime": "2018-10-29T02:29:11Z", "eventName": "GetObject", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "74.178.214.222", "userAgent": "aws-sdk-java/1.11.879 Linux/4.14.225-169.362.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/25.275-b01", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAD60J9SMN9M772UW9", "userName": "backup"}, "requestParameters": {"bucketName": "prod-data-2872", "key": "customer/02795.json"}, "resources": [{"ARN": "arn:aws:s3:::prod-data-2872"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4451e169-55d1-41c5-991b-070dd393ef5d", "record_id": "flaws_cloudtrail:0000274:4451e169-55d1-41c5-991b-070dd393ef5d", "row_index": 274, "timestamp": "2018-10-29T02:30:04Z", "event_type": "GetObject", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAD60J9SMN9M772UW9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "74.178.214.222", "user_agent": "aws-sdk-java/1.11.879 Linux/4.14.225-169.362.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/25.275-b01", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:s3:::prod-data-2872"], "raw_record_size_bytes": 668, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4451e169-55d1-41c5-991b-070dd393ef5d", "eventTime": "2018-10-29T02:30:04Z", "eventName": "GetObject", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "74.178.214.222", "userAgent": "aws-sdk-java/1.11.879 Linux/4.14.225-169.362.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/25.275-b01", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAD60J9SMN9M772UW9", "userName": "backup"}, "requestParameters": {"bucketName": "prod-data-2872", "key": "customer/06129.json"}, "resources": [{"ARN": "arn:aws:s3:::prod-data-2872"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf602cc8-ec6e-4230-b2fd-25f3d6f96391", "record_id": "flaws_cloudtrail:0000275:bf602cc8-ec6e-4230-b2fd-25f3d6f96391", "row_index": 275, "timestamp": "2018-10-29T02:30:40Z", "event_type": "GetObject", "event_source": "s3.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIAD60J9SMN9M772UW9", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "74.178.214.222", "user_agent": "aws-sdk-java/1.11.879 Linux/4.14.225-169.362.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/25.275-b01", "aws_region": "us-east-1"}, "resource_arns": ["arn:aws:s3:::prod-data-2872"], "raw_record_size_bytes": 668, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "requestParameters", "resources", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf602cc8-ec6e-4230-b2fd-25f3d6f96391", "eventTime": "2018-10-29T02:30:40Z", "eventName": "GetObject", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "74.178.214.222", "userAgent": "aws-sdk-java/1.11.879 Linux/4.14.225-169.362.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/25.275-b01", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIAD60J9SMN9M772UW9", "userName": "backup"}, "requestParameters": {"bucketName": "prod-data-2872", "key": "customer/02544.json"}, "resources": [{"ARN": "arn:aws:s3:::prod-data-2872"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1ff3d911-05c1-49cb-b0f4-a9209dc46f1a", "record_id": "flaws_cloudtrail:0000276:1ff3d911-05c1-49cb-b0f4-a9209dc46f1a", "row_index": 276, "timestamp": "2018-10-29T02:35:24Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "209.178.1.197", "user_agent": "aws-cli/1.16.6 Python/2.7.10 Darwin/17.5.0 botocore/1.11.6", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 657, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1ff3d911-05c1-49cb-b0f4-a9209dc46f1a", "eventTime": "2018-10-29T02:35:24Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "209.178.1.197", "userAgent": "aws-cli/1.16.6 Python/2.7.10 Darwin/17.5.0 botocore/1.11.6", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b51cf495-c3da-46d1-aa25-85689ec37ed", "record_id": "flaws_cloudtrail:0000277:b51cf495-c3da-46d1-aa25-85689ec37ed", "row_index": 277, "timestamp": "2018-10-29T02:35:31Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "209.178.1.197", "user_agent": "aws-cli/1.16.6 Python/2.7.10 Darwin/17.5.0 botocore/1.11.6", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 690, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b51cf495-c3da-46d1-aa25-85689ec37ed", "eventTime": "2018-10-29T02:35:31Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "209.178.1.197", "userAgent": "aws-cli/1.16.6 Python/2.7.10 Darwin/17.5.0 botocore/1.11.6", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e8f74d26-8e57-4e38-adce-645b87ca41a6", "record_id": "flaws_cloudtrail:0000278:e8f74d26-8e57-4e38-adce-645b87ca41a6", "row_index": 278, "timestamp": "2018-10-29T02:37:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "lambda.amazonaws.com", "user_agent": "lambda.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/service-role/Level6"], "raw_record_size_bytes": 1217, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e8f74d26-8e57-4e38-adce-645b87ca41a6", "eventTime": "2018-10-29T02:37:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "lambda.amazonaws.com", "userAgent": "lambda.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "lambda.amazonaws.com"}, "requestParameters": {"roleSessionName": "Level6", "roleArn": "arn:aws:iam::811596193553:role/service-role/Level6"}, "responseElements": {"credentials": {"accessKeyId": "ASIABGIPC2401M584SH9", "expiration": "Oct 29, 2018 2:37:09 PM", "sessionToken": "FQoGZXIvYXdzEGwaDBt4aixVVNenFR8fGiLfAdEg9QIf4brQJCn3nExa1Ad9ssiR40ukqJhL2jww2WUiWtFS5PeqtpTZzedjrIHR2BQqR27F5DZqVRPWU5y+lpgmC+LrRk20rLrPYSR95+9sAdlLFBD+VygRd/Es5C3Js1nxDAWsDp/JryQcplKFEygYm6qHkgWFhjJ0oHjkxNz1JZBmJREzOQbOdMMMp9/ZQXMa3nCdX0OfeJ9N7SMXyqL7COEVT4ShXezjsusnwgYVCyLh7REytwStU6hRLQeNZggmpbbuDFioR4hEKNwlFssqDsIiuU1eNLR0V54ZW40o1eTZ3gU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cdc7a1de-c7eb-4360-8c09-ead52b4e82c0", "record_id": "flaws_cloudtrail:0000279:cdc7a1de-c7eb-4360-8c09-ead52b4e82c0", "row_index": 279, "timestamp": "2018-10-29T02:37:09Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIABGIPC2401M584SH9", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "7.196.218.158", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1030, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cdc7a1de-c7eb-4360-8c09-ead52b4e82c0", "eventTime": "2018-10-29T02:37:09Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.196.218.158", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIABGIPC2401M584SH9", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-10-29T02:37:09Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logGroupName": "/aws/lambda/Level6", "logStreamName": "2018/10/29/[$LATEST]22e884f57ee1b0ef1cbd7fd1eda82a60"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f699c31b-d3a8-47da-9c60-c1d8a12cbe2d", "record_id": "flaws_cloudtrail:0000280:f699c31b-d3a8-47da-9c60-c1d8a12cbe2d", "row_index": 280, "timestamp": "2018-10-29T03:08:15Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "7.6.251.225", "user_agent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 651, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f699c31b-d3a8-47da-9c60-c1d8a12cbe2d", "eventTime": "2018-10-29T03:08:15Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "7.6.251.225", "userAgent": "aws-cli/1.16.10 Python/2.7.9 Windows/8 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e639fc4b-5503-4943-bbc6-e66dae2b1e01", "record_id": "flaws_cloudtrail:0000281:e639fc4b-5503-4943-bbc6-e66dae2b1e01", "row_index": 281, "timestamp": "2018-10-29T03:09:08Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIABGIPC2401M584SH9", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "230.29.253.3", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1029, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e639fc4b-5503-4943-bbc6-e66dae2b1e01", "eventTime": "2018-10-29T03:09:08Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "230.29.253.3", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIABGIPC2401M584SH9", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-10-29T02:37:09Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logGroupName": "/aws/lambda/Level6", "logStreamName": "2018/10/29/[$LATEST]8a269900c317fbc17c0e0b0bad88bc9f"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9ac73efe-6ed3-4e89-b074-f995a2f096cc", "record_id": "flaws_cloudtrail:0000282:9ac73efe-6ed3-4e89-b074-f995a2f096cc", "row_index": 282, "timestamp": "2018-10-29T03:10:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1480, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9ac73efe-6ed3-4e89-b074-f995a2f096cc", "eventTime": "2018-10-29T03:10:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA5D5Z49TG423RK5TA", "expiration": "Oct 29, 2018 9:26:19 AM", "sessionToken": "FQoGZXIvYXdzEG0aDJpP6I4PsHngAjIXFSK3AyMSGdNNjPm7fbSOmFEeuaa4VxxmBhWlJIotoXQvQ4gunZTJyAvEil5AGGRpSxRYU7M7cZPnpR2z5KBFAr8VNUpoECrC5ZtTpJxmUIWYhpnqnI/qMMPL2xDf1gC1Y8cDcFbMxg+VPXeZAjKvBIBTelMUB4y85C70W3gyyArSmulh411IWpZcRghlDzHtiUyN54D94cw78p0hHpGJLfbl9f4tCcBp+THAaV8RRvk0GXmmCcT5CGAh07s1Uu7bWxcyThIjIoSmuoRFFzU7fx0jhlj6vS5mUVHm8IH+ggaKyojbUG+mhSfyGyTelusi5m6RJC8nIZurh2EVkkWJGhoLwYOnLu1ITQ5ikbrdDTrr7QEBd2wE2zEKhnNO2vQIpVe4s38KioXjUG7OvM4MThgUPGFTnNPGPTqs7lkHTICWHKw7qdTNc7EdzDJl9Wk/PSoeOIvsTXrFf+wzjHkECH1H1tBKHi/I4c7pAkVg7Tho7lBm+qKAwD5wj7bn2iJPmmbZOO5fjcb6ZZFS9qvlnMgBD1xAfg9PUmMJ7DAyp/V8CQgTQ2Ra60BJWomZKWA72MMNYH94aciuX2Iow/TZ3gU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "52d8dea7-0fa4-4590-976e-ab77c5dc538e", "record_id": "flaws_cloudtrail:0000283:52d8dea7-0fa4-4590-976e-ab77c5dc538e", "row_index": 283, "timestamp": "2018-10-29T03:30:58Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 827, "raw_record_depth": 8, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "52d8dea7-0fa4-4590-976e-ab77c5dc538e", "eventTime": "2018-10-29T03:30:58Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotSet": {}, "ownersSet": {}, "sharedUsersSet": {}, "filterSet": {"items": [{"name": "volume-id", "valueSet": {"items": {"__truncated_type": "list"}}}]}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "760057b44-9985-41b7-a1aa-9c2ae555ecb1", "record_id": "flaws_cloudtrail:0000284:760057b44-9985-41b7-a1aa-9c2ae555ecb1", "row_index": 284, "timestamp": "2018-10-29T03:32:13Z", "event_type": "DescribeSnapshotAttribute", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 763, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "760057b44-9985-41b7-a1aa-9c2ae555ecb1", "eventTime": "2018-10-29T03:32:13Z", "eventName": "DescribeSnapshotAttribute", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "attributeType": "CREATE_VOLUME_PERMISSION"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "28f28f27-e16f-4a22-a0f8-1dfb308b451a", "record_id": "flaws_cloudtrail:0000285:28f28f27-e16f-4a22-a0f8-1dfb308b451a", "row_index": 285, "timestamp": "2018-10-29T03:32:35Z", "event_type": "CreateVolume", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIA5D5Z49TG423RK5TA", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1822, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "28f28f27-e16f-4a22-a0f8-1dfb308b451a", "eventTime": "2018-10-29T03:32:35Z", "eventName": "CreateVolume", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation. Encoded authorization failure message: YnXe8xQXKZpN2iKWUSmfMrZQ8UyevE222SJ4ONdtq2TTNqauJGKe5vEHodUNUaJs-SQLbEFkLBTGpFKNM-3eCNmy9L5QkbsCqiWZ_31KC7L7nFTZomq-jYx74gGdWNJupbqJ7SkCYfWK0Q50vjcBZpc5BCVIfbDJbax2htl7RLWufHKLpiizFsrVdiprIEi2YYhqhf-6Z9nRORf1FVV2y-kMyadbCCSuP3NNgbuHxRl8JFhixsEO7peXt7oB_uCrr7dC6CviyxnwsBn4czmzP0VGkvL8gK_2bMbQrKPx2y8k1SripqVS2_D4sN0kxWpkHPJ2yYow6VpPg-4B0T5pa9ptpgIq1f0RYBO4dV-JbMWOH_Gps6XwFKDA7GEVGz8ulReQpiadfpTuEzp53MwGZgJct39XPVRyZSi1B5vi062nvZkG7ohN8VXinsNFtSQF-GFOU76j7lpcw_HwDZvIfBFjBBFLCCQrWAlNqjnDRhGuEceQ-x5IUbjW___LJvjswHnm4hEtaKoC5npSv7_jM53wyw4ZSjfvlwgvIEwIEwi8OW3s5gQzGDRDobsUqEq-bcnNDNZhoeyrYLZMqLXDIwEKl9Qw1UhWKTitGVb82X1c9jq3qWkTgAN1OK8j_tGi2J--zSPXw0BRd00", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIA5D5Z49TG423RK5TA", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-10-29T03:10:59Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"snapshotId": "snap-83d15d668fb2941db", "zone": "us-west-2a"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "16c8edc9-c5db-4e41-8751-3df771d0224a", "record_id": "flaws_cloudtrail:0000286:16c8edc9-c5db-4e41-8751-3df771d0224a", "row_index": 286, "timestamp": "2018-10-29T03:34:02Z", "event_type": "DescribeVolumes", "event_source": "ec2.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIA5D5Z49TG423RK5TA", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "3.7.7.54", "user_agent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1120, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "16c8edc9-c5db-4e41-8751-3df771d0224a", "eventTime": "2018-10-29T03:34:02Z", "eventName": "DescribeVolumes", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "3.7.7.54", "userAgent": "aws-cli/1.14.44 Python/3.6.6 Linux/4.4.0-53329-Microsoft botocore/1.8.48", "awsRegion": "us-west-2", "errorCode": "Client.UnauthorizedOperation", "errorMessage": "You are not authorized to perform this operation.", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIA5D5Z49TG423RK5TA", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-10-29T03:10:59Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "requestParameters": {"maxResults": 1000, "volumeSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "14c225b0-b2fb-41cc-bff5-aef2ad41189", "record_id": "flaws_cloudtrail:0000287:14c225b0-b2fb-41cc-bff5-aef2ad41189", "row_index": 287, "timestamp": "2018-10-29T04:07:44Z", "event_type": "ListBuckets", "event_source": "s3.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIAPXLL4TUVTUPVHBT0", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "16.9.0.4", "user_agent": "[aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70]", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 994, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "14c225b0-b2fb-41cc-bff5-aef2ad41189", "eventTime": "2018-10-29T04:07:44Z", "eventName": "ListBuckets", "eventSource": "s3.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.9.0.4", "userAgent": "[aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70]", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "Access Denied", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIAPXLL4TUVTUPVHBT0", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-10-29T02:10:59Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4558eec1-1a93-47bc-a6c7-cb58c7c7ae9c", "record_id": "flaws_cloudtrail:0000288:4558eec1-1a93-47bc-a6c7-cb58c7c7ae9c", "row_index": 288, "timestamp": "2018-10-29T04:10:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "AWSService", "arn": null, "account_id": null, "principal_id": null, "user_name": null, "access_key_id": null, "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "ec2.amazonaws.com", "user_agent": "ec2.amazonaws.com", "aws_region": "us-west-2"}, "resource_arns": ["arn:aws:iam::811596193553:role/flaws"], "raw_record_size_bytes": 1483, "raw_record_depth": 3, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "resources", "responseElements", "sharedEventID", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4558eec1-1a93-47bc-a6c7-cb58c7c7ae9c", "eventTime": "2018-10-29T04:10:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "ec2.amazonaws.com", "userAgent": "ec2.amazonaws.com", "awsRegion": "us-west-2", "userIdentity": {"type": "AWSService", "invokedBy": "ec2.amazonaws.com"}, "requestParameters": {"roleSessionName": "i-aa2d3b42e5c6e801a", "roleArn": "arn:aws:iam::811596193553:role/flaws"}, "responseElements": {"credentials": {"accessKeyId": "ASIA0A36B714XDZFIWSY", "expiration": "Oct 29, 2018 10:20:54 AM", "sessionToken": "FQoGZXIvYXdzEG4aDLBfUM3BU78r4yhJaCK3AxhpmVeFKOeiuaDiqhviEnfDjYP+QjBJvY8EtRgfTUifuujgaOtJBajmEpyjcjbB/sowtxerKrHq+2F1/o3bO7gq3HCILPeceywqhO0fBx8XB9w/t9C2tNB81eGOYXZhzXJtXmfCXCQkeWYmIS5Jb+Qx3HmDJkCWb40DxrMi6kl6m/ZQCDQrsJ1ADlePIdKfudgvyZPRtm2eZ71TRDgsUzohvjFqlbDFPg4gTsZ6GsqHnEq5/UbVoAvY9Sk3fPUaLyN7FEOA+Aoh5zTkZHJINO02iSa6QRoRRlCHSu4NmacMsLvUx68IrEt5s/82eX0636K02fw3nWmEY2+kx2ofL2gK+gz9elO+bCX/2MjYms5SL1CyOucTQkxyRuJ4qIAh041JkRLCnDvrGLeSUxIqVuLoqAqwCcvPWDRWiFzb6VS4VF0MJFZD8C3nV0YxZPMt6gllEOBdpxxabW3st2iLbnIjrqKLwYpYC4jZBbQZla8Ce0Haeyk5/2LNf0VNYPAe6dF1WKrvoOz1t2pIQuMvGH3+jVcsQm5uvdPmGaZnYL0XNtO7XfouFU1W/Zx6Z4d/llSgNkBfi9Ao05Da3gU="}}, "resources": [{"ARN": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "type": "AWS::IAM::Role"}]}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d94d97ee-c9b1-4630-bbdd-c2fc2e166ead", "record_id": "flaws_cloudtrail:0000289:d94d97ee-c9b1-4630-bbdd-c2fc2e166ead", "row_index": 289, "timestamp": "2018-10-29T04:11:49Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "16.9.0.4", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 661, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d94d97ee-c9b1-4630-bbdd-c2fc2e166ead", "eventTime": "2018-10-29T04:11:49Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.9.0.4", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "449e426a-13bd-4243-94ce-465035bd9537", "record_id": "flaws_cloudtrail:0000290:449e426a-13bd-4243-94ce-465035bd9537", "row_index": 290, "timestamp": "2018-10-29T04:12:38Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "16.9.0.4", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "449e426a-13bd-4243-94ce-465035bd9537", "eventTime": "2018-10-29T04:12:38Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.9.0.4", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "74e2f49b-22b7-43a8-b8e7-b6fd186523f76", "record_id": "flaws_cloudtrail:0000291:74e2f49b-22b7-43a8-b8e7-b6fd186523f76", "row_index": 291, "timestamp": "2018-10-29T04:14:57Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "16.9.0.4", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 725, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "74e2f49b-22b7-43a8-b8e7-b6fd186523f76", "eventTime": "2018-10-29T04:14:57Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.9.0.4", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "05c20ade-5ae9-4818-8d16-04795b17f80", "record_id": "flaws_cloudtrail:0000292:05c20ade-5ae9-4818-8d16-04795b17f80", "row_index": 292, "timestamp": "2018-10-29T04:15:56Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "16.9.0.4", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 747, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "05c20ade-5ae9-4818-8d16-04795b17f80", "eventTime": "2018-10-29T04:15:56Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.9.0.4", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e259570f8-7554-42fa-910b-23db482fa25b", "record_id": "flaws_cloudtrail:0000293:e259570f8-7554-42fa-910b-23db482fa25b", "row_index": 293, "timestamp": "2018-10-29T04:20:32Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "account_id": "811596193553", "principal_id": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "user_name": null, "access_key_id": "ASIA0A36B714XDZFIWSY", "session_issuer_arn": "arn:aws:iam::811596193553:role/flaws", "session_issuer_user_name": "flaws"}, "network": {"source_ip": "9.96.24.205", "user_agent": "aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 1156, "raw_record_depth": 4, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e259570f8-7554-42fa-910b-23db482fa25b", "eventTime": "2018-10-29T04:20:32Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.96.24.205", "userAgent": "aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a is not authorized to perform: iam:GetUser on resource: user i-aa2d3b42e5c6e801a", "userIdentity": {"type": "AssumedRole", "principalId": "AROACW5CSA8C8WHOB3O7Q:i-aa2d3b42e5c6e801a", "arn": "arn:aws:sts::811596193553:assumed-role/flaws/i-aa2d3b42e5c6e801a", "accountId": "811596193553", "accessKeyId": "ASIA0A36B714XDZFIWSY", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-10-29T04:10:59Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROACW5CSA8C8WHOB3O7Q", "arn": "arn:aws:iam::811596193553:role/flaws", "accountId": "811596193553", "userName": "flaws"}}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f1272a97-763b-458c-a4de-ce2c483b9651", "record_id": "flaws_cloudtrail:0000294:f1272a97-763b-458c-a4de-ce2c483b9651", "row_index": 294, "timestamp": "2018-10-29T04:23:07Z", "event_type": "DescribeSnapshots", "event_source": "ec2.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "95.136.137.7", "user_agent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 798, "raw_record_depth": 5, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f1272a97-763b-458c-a4de-ce2c483b9651", "eventTime": "2018-10-29T04:23:07Z", "eventName": "DescribeSnapshots", "eventSource": "ec2.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "95.136.137.7", "userAgent": "aws-cli/1.16.42 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.12.32", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "requestParameters": {"maxResults": 1000, "snapshotSet": {}, "ownersSet": {"items": [{"owner": "811596193553"}]}, "sharedUsersSet": {}, "filterSet": {}}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "40dcd590-2e18-401d-9f19-a7e2779c0351", "record_id": "flaws_cloudtrail:0000295:40dcd590-2e18-401d-9f19-a7e2779c0351", "row_index": 295, "timestamp": "2018-10-29T04:23:09Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.96.24.205", "user_agent": "aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 669, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "40dcd590-2e18-401d-9f19-a7e2779c0351", "eventTime": "2018-10-29T04:23:09Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.96.24.205", "userAgent": "aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9a50e4c5-1706-42b0-9874-ff74af1ba228", "record_id": "flaws_cloudtrail:0000296:9a50e4c5-1706-42b0-9874-ff74af1ba228", "row_index": 296, "timestamp": "2018-10-29T04:23:28Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.96.24.205", "user_agent": "aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9a50e4c5-1706-42b0-9874-ff74af1ba228", "eventTime": "2018-10-29T04:23:28Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.96.24.205", "userAgent": "aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c79142-5be0-44e2-85ea-e14dceb37ad4", "record_id": "flaws_cloudtrail:0000297:c79142-5be0-44e2-85ea-e14dceb37ad4", "row_index": 297, "timestamp": "2018-10-29T04:26:58Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.96.24.205", "user_agent": "aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 730, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c79142-5be0-44e2-85ea-e14dceb37ad4", "eventTime": "2018-10-29T04:26:58Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.96.24.205", "userAgent": "aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6cfe3699-beba-42f2-bba9-aa5b7e05e351", "record_id": "flaws_cloudtrail:0000298:6cfe3699-beba-42f2-bba9-aa5b7e05e351", "row_index": 298, "timestamp": "2018-10-29T04:27:31Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6cfe3699-beba-42f2-bba9-aa5b7e05e351", "eventTime": "2018-10-29T04:27:31Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0b8374c6-a12a-4ba0-83a0-755acd1bfbf2", "record_id": "flaws_cloudtrail:0000299:0b8374c6-a12a-4ba0-83a0-755acd1bfbf2", "row_index": 299, "timestamp": "2018-10-29T04:27:38Z", "event_type": "GetPolicyVersion", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.96.24.205", "user_agent": "aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 756, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0b8374c6-a12a-4ba0-83a0-755acd1bfbf2", "eventTime": "2018-10-29T04:27:38Z", "eventName": "GetPolicyVersion", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.96.24.205", "userAgent": "aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways", "versionId": "v4"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "62c6532b-f447-48fb-b28d-b54b75f8dbf7", "record_id": "flaws_cloudtrail:0000300:62c6532b-f447-48fb-b28d-b54b75f8dbf7", "row_index": 300, "timestamp": "2018-10-29T04:27:40Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "62c6532b-f447-48fb-b28d-b54b75f8dbf7", "eventTime": "2018-10-29T04:27:40Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a5c3f6fc-0246-4a46-bb35-77eda1e68beb", "record_id": "flaws_cloudtrail:0000301:a5c3f6fc-0246-4a46-bb35-77eda1e68beb", "row_index": 301, "timestamp": "2018-10-29T04:27:46Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a5c3f6fc-0246-4a46-bb35-77eda1e68beb", "eventTime": "2018-10-29T04:27:46Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "70ef0ae7-b1f6-4085-ad92-dedf3658ddf8", "record_id": "flaws_cloudtrail:0000302:70ef0ae7-b1f6-4085-ad92-dedf3658ddf8", "row_index": 302, "timestamp": "2018-10-29T04:27:53Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "70ef0ae7-b1f6-4085-ad92-dedf3658ddf8", "eventTime": "2018-10-29T04:27:53Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bd5699b5-0707-4101-a71d-144c7c547632", "record_id": "flaws_cloudtrail:0000303:bd5699b5-0707-4101-a71d-144c7c547632", "row_index": 303, "timestamp": "2018-10-29T04:27:54Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bd5699b5-0707-4101-a71d-144c7c547632", "eventTime": "2018-10-29T04:27:54Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5f5d3cd1-02e6-409a-a62f-9d85035a488a", "record_id": "flaws_cloudtrail:0000304:5f5d3cd1-02e6-409a-a62f-9d85035a488a", "row_index": 304, "timestamp": "2018-10-29T04:27:55Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5f5d3cd1-02e6-409a-a62f-9d85035a488a", "eventTime": "2018-10-29T04:27:55Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "37c9e5d5-9bca-4efe-b520-aab14f2c68a0", "record_id": "flaws_cloudtrail:0000305:37c9e5d5-9bca-4efe-b520-aab14f2c68a0", "row_index": 305, "timestamp": "2018-10-29T04:27:56Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 905, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "37c9e5d5-9bca-4efe-b520-aab14f2c68a0", "eventTime": "2018-10-29T04:27:56Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "232d9923-37ef-49d6-942d-bfb129893041", "record_id": "flaws_cloudtrail:0000306:232d9923-37ef-49d6-942d-bfb129893041", "row_index": 306, "timestamp": "2018-10-29T04:27:56Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "232d9923-37ef-49d6-942d-bfb129893041", "eventTime": "2018-10-29T04:27:56Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4d58bb50-4fd7-47ea-a7d1-2e61e0f80cae", "record_id": "flaws_cloudtrail:0000307:4d58bb50-4fd7-47ea-a7d1-2e61e0f80cae", "row_index": 307, "timestamp": "2018-10-29T04:27:57Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4d58bb50-4fd7-47ea-a7d1-2e61e0f80cae", "eventTime": "2018-10-29T04:27:57Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ecc15f82-bb6a-4678-b57f-4a5552eb9a24", "record_id": "flaws_cloudtrail:0000308:ecc15f82-bb6a-4678-b57f-4a5552eb9a24", "row_index": 308, "timestamp": "2018-10-29T04:27:58Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ecc15f82-bb6a-4678-b57f-4a5552eb9a24", "eventTime": "2018-10-29T04:27:58Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ba08b9ef-0ea6-489f-a6f1-1e438e9cdac4", "record_id": "flaws_cloudtrail:0000309:ba08b9ef-0ea6-489f-a6f1-1e438e9cdac4", "row_index": 309, "timestamp": "2018-10-29T04:27:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ba08b9ef-0ea6-489f-a6f1-1e438e9cdac4", "eventTime": "2018-10-29T04:27:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "af5a7878-fac3-4960-a03c-76fc8cc70c3e", "record_id": "flaws_cloudtrail:0000310:af5a7878-fac3-4960-a03c-76fc8cc70c3e", "row_index": 310, "timestamp": "2018-10-29T04:28:00Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "af5a7878-fac3-4960-a03c-76fc8cc70c3e", "eventTime": "2018-10-29T04:28:00Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ccfa9d7b-628a-4ed2-8e87-818c96910cff", "record_id": "flaws_cloudtrail:0000311:ccfa9d7b-628a-4ed2-8e87-818c96910cff", "row_index": 311, "timestamp": "2018-10-29T04:28:00Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "16.9.0.4", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 677, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ccfa9d7b-628a-4ed2-8e87-818c96910cff", "eventTime": "2018-10-29T04:28:00Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.9.0.4", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "091031d5b-2cc3-46ef-9385-115931dfa0c7c", "record_id": "flaws_cloudtrail:0000312:091031d5b-2cc3-46ef-9385-115931dfa0c7c", "row_index": 312, "timestamp": "2018-10-29T04:28:01Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "091031d5b-2cc3-46ef-9385-115931dfa0c7c", "eventTime": "2018-10-29T04:28:01Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6ba7dc8b-0d05-4b49-be5e-e14097ef23d5", "record_id": "flaws_cloudtrail:0000313:6ba7dc8b-0d05-4b49-be5e-e14097ef23d5", "row_index": 313, "timestamp": "2018-10-29T04:28:01Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6ba7dc8b-0d05-4b49-be5e-e14097ef23d5", "eventTime": "2018-10-29T04:28:01Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf249b69-37c8-4c8b-8e61-e4ddd5d8579e", "record_id": "flaws_cloudtrail:0000314:bf249b69-37c8-4c8b-8e61-e4ddd5d8579e", "row_index": 314, "timestamp": "2018-10-29T04:28:02Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf249b69-37c8-4c8b-8e61-e4ddd5d8579e", "eventTime": "2018-10-29T04:28:02Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e259172-d109-4367-9184-b3d91333", "record_id": "flaws_cloudtrail:0000315:e259172-d109-4367-9184-b3d91333", "row_index": 315, "timestamp": "2018-10-29T04:28:03Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 902, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e259172-d109-4367-9184-b3d91333", "eventTime": "2018-10-29T04:28:03Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4492a21e-a715-402c-98b9-d3dbab324151", "record_id": "flaws_cloudtrail:0000316:4492a21e-a715-402c-98b9-d3dbab324151", "row_index": 316, "timestamp": "2018-10-29T04:28:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4492a21e-a715-402c-98b9-d3dbab324151", "eventTime": "2018-10-29T04:28:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b9fbf122-5e78-4e30-9f52-40ea7ff89ac0", "record_id": "flaws_cloudtrail:0000317:b9fbf122-5e78-4e30-9f52-40ea7ff89ac0", "row_index": 317, "timestamp": "2018-10-29T04:28:05Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b9fbf122-5e78-4e30-9f52-40ea7ff89ac0", "eventTime": "2018-10-29T04:28:05Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e7fba0a3-1c2c-4c12-9396-d34a9d2fd72c", "record_id": "flaws_cloudtrail:0000318:e7fba0a3-1c2c-4c12-9396-d34a9d2fd72c", "row_index": 318, "timestamp": "2018-10-29T04:28:06Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e7fba0a3-1c2c-4c12-9396-d34a9d2fd72c", "eventTime": "2018-10-29T04:28:06Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ec1485f3-856c-4fe4-891d-ecd46dbac852", "record_id": "flaws_cloudtrail:0000319:ec1485f3-856c-4fe4-891d-ecd46dbac852", "row_index": 319, "timestamp": "2018-10-29T04:28:06Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 904, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ec1485f3-856c-4fe4-891d-ecd46dbac852", "eventTime": "2018-10-29T04:28:06Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4064bc56-3312-4491-b759-286d20ae3e34", "record_id": "flaws_cloudtrail:0000320:4064bc56-3312-4491-b759-286d20ae3e34", "row_index": 320, "timestamp": "2018-10-29T04:28:07Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 905, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4064bc56-3312-4491-b759-286d20ae3e34", "eventTime": "2018-10-29T04:28:07Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cdb456089-967a-4591-9b94-e73a8d87a19c", "record_id": "flaws_cloudtrail:0000321:cdb456089-967a-4591-9b94-e73a8d87a19c", "row_index": 321, "timestamp": "2018-10-29T04:28:08Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cdb456089-967a-4591-9b94-e73a8d87a19c", "eventTime": "2018-10-29T04:28:08Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4cf541813-bba7-44ed-8ae2-75fc8fee4351", "record_id": "flaws_cloudtrail:0000322:4cf541813-bba7-44ed-8ae2-75fc8fee4351", "row_index": 322, "timestamp": "2018-10-29T04:28:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4cf541813-bba7-44ed-8ae2-75fc8fee4351", "eventTime": "2018-10-29T04:28:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5c2e76e5-0c35-44a6-8efb-2eab96bd57e7", "record_id": "flaws_cloudtrail:0000323:5c2e76e5-0c35-44a6-8efb-2eab96bd57e7", "row_index": 323, "timestamp": "2018-10-29T04:28:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5c2e76e5-0c35-44a6-8efb-2eab96bd57e7", "eventTime": "2018-10-29T04:28:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "98e75ac3-fbe0-4ce9-882a-40655ab0b468", "record_id": "flaws_cloudtrail:0000324:98e75ac3-fbe0-4ce9-882a-40655ab0b468", "row_index": 324, "timestamp": "2018-10-29T04:28:11Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "98e75ac3-fbe0-4ce9-882a-40655ab0b468", "eventTime": "2018-10-29T04:28:11Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "82538-bdc3-4175-b1a1-7cb2a904a588", "record_id": "flaws_cloudtrail:0000325:82538-bdc3-4175-b1a1-7cb2a904a588", "row_index": 325, "timestamp": "2018-10-29T04:28:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 904, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "82538-bdc3-4175-b1a1-7cb2a904a588", "eventTime": "2018-10-29T04:28:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d533ad20-61dc-4d8a-97fd-f4ff6852977f", "record_id": "flaws_cloudtrail:0000326:d533ad20-61dc-4d8a-97fd-f4ff6852977f", "row_index": 326, "timestamp": "2018-10-29T04:28:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d533ad20-61dc-4d8a-97fd-f4ff6852977f", "eventTime": "2018-10-29T04:28:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6c700e8a-9b79-4679-9afa-39f271fa7a3a", "record_id": "flaws_cloudtrail:0000327:6c700e8a-9b79-4679-9afa-39f271fa7a3a", "row_index": 327, "timestamp": "2018-10-29T04:28:14Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6c700e8a-9b79-4679-9afa-39f271fa7a3a", "eventTime": "2018-10-29T04:28:14Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6033c23f-89f4-49a7-a073-e4d88ffdd8ec", "record_id": "flaws_cloudtrail:0000328:6033c23f-89f4-49a7-a073-e4d88ffdd8ec", "row_index": 328, "timestamp": "2018-10-29T04:28:15Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6033c23f-89f4-49a7-a073-e4d88ffdd8ec", "eventTime": "2018-10-29T04:28:15Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dea251575-2c76-4a7a-b7b0-db1429ce2132", "record_id": "flaws_cloudtrail:0000329:dea251575-2c76-4a7a-b7b0-db1429ce2132", "row_index": 329, "timestamp": "2018-10-29T04:28:16Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dea251575-2c76-4a7a-b7b0-db1429ce2132", "eventTime": "2018-10-29T04:28:16Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8c90ba06-5f56-48b6-a0c9-d8e79bac6a1a", "record_id": "flaws_cloudtrail:0000330:8c90ba06-5f56-48b6-a0c9-d8e79bac6a1a", "row_index": 330, "timestamp": "2018-10-29T04:28:16Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8c90ba06-5f56-48b6-a0c9-d8e79bac6a1a", "eventTime": "2018-10-29T04:28:16Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "49c461728-d443-4aa5-b5c1-ddcc090250", "record_id": "flaws_cloudtrail:0000331:49c461728-d443-4aa5-b5c1-ddcc090250", "row_index": 331, "timestamp": "2018-10-29T04:28:17Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 906, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "49c461728-d443-4aa5-b5c1-ddcc090250", "eventTime": "2018-10-29T04:28:17Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9d0bfb1c-9f93-41d5-acdf-518daf503a84", "record_id": "flaws_cloudtrail:0000332:9d0bfb1c-9f93-41d5-acdf-518daf503a84", "row_index": 332, "timestamp": "2018-10-29T04:28:18Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9d0bfb1c-9f93-41d5-acdf-518daf503a84", "eventTime": "2018-10-29T04:28:18Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ef78d90a-fa31-4b2d-a10b-b35a2ffd7b79", "record_id": "flaws_cloudtrail:0000333:ef78d90a-fa31-4b2d-a10b-b35a2ffd7b79", "row_index": 333, "timestamp": "2018-10-29T04:28:19Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 906, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ef78d90a-fa31-4b2d-a10b-b35a2ffd7b79", "eventTime": "2018-10-29T04:28:19Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e412ebdb-203c-424d-b561-5d0f785c06c9", "record_id": "flaws_cloudtrail:0000334:e412ebdb-203c-424d-b561-5d0f785c06c9", "row_index": 334, "timestamp": "2018-10-29T04:28:20Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e412ebdb-203c-424d-b561-5d0f785c06c9", "eventTime": "2018-10-29T04:28:20Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "97ce6671-254f-4714-8625-40ccbf70ec55", "record_id": "flaws_cloudtrail:0000335:97ce6671-254f-4714-8625-40ccbf70ec55", "row_index": 335, "timestamp": "2018-10-29T04:28:21Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "97ce6671-254f-4714-8625-40ccbf70ec55", "eventTime": "2018-10-29T04:28:21Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff60bf09-9336-4d9d-aab9-6d91f161cb40", "record_id": "flaws_cloudtrail:0000336:ff60bf09-9336-4d9d-aab9-6d91f161cb40", "row_index": 336, "timestamp": "2018-10-29T04:28:21Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 904, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff60bf09-9336-4d9d-aab9-6d91f161cb40", "eventTime": "2018-10-29T04:28:21Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b207ea96-cd82-43cb-ab3b-12215d5cf0a1", "record_id": "flaws_cloudtrail:0000337:b207ea96-cd82-43cb-ab3b-12215d5cf0a1", "row_index": 337, "timestamp": "2018-10-29T04:28:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b207ea96-cd82-43cb-ab3b-12215d5cf0a1", "eventTime": "2018-10-29T04:28:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d1bfadc8-0f37-463c-8ffb-3441b048d679", "record_id": "flaws_cloudtrail:0000338:d1bfadc8-0f37-463c-8ffb-3441b048d679", "row_index": 338, "timestamp": "2018-10-29T04:28:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d1bfadc8-0f37-463c-8ffb-3441b048d679", "eventTime": "2018-10-29T04:28:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9335ebbd-7f2d-46cc-8a92-fad7b6a94559", "record_id": "flaws_cloudtrail:0000339:9335ebbd-7f2d-46cc-8a92-fad7b6a94559", "row_index": 339, "timestamp": "2018-10-29T04:28:24Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9335ebbd-7f2d-46cc-8a92-fad7b6a94559", "eventTime": "2018-10-29T04:28:24Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dadb6bc3-91ba-4460-8a3b-de8a7bbc9de1", "record_id": "flaws_cloudtrail:0000340:dadb6bc3-91ba-4460-8a3b-de8a7bbc9de1", "row_index": 340, "timestamp": "2018-10-29T04:28:25Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dadb6bc3-91ba-4460-8a3b-de8a7bbc9de1", "eventTime": "2018-10-29T04:28:25Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "000010d58-033b-483d-a935-7acaf5ff3561", "record_id": "flaws_cloudtrail:0000341:000010d58-033b-483d-a935-7acaf5ff3561", "row_index": 341, "timestamp": "2018-10-29T04:28:26Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "000010d58-033b-483d-a935-7acaf5ff3561", "eventTime": "2018-10-29T04:28:26Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d35491f-e4e9-41dc-978d-0703d39e0c3c", "record_id": "flaws_cloudtrail:0000342:d35491f-e4e9-41dc-978d-0703d39e0c3c", "row_index": 342, "timestamp": "2018-10-29T04:28:26Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 906, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d35491f-e4e9-41dc-978d-0703d39e0c3c", "eventTime": "2018-10-29T04:28:26Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "75f769425-a9d6-4a87-b5ca-6bc4236d7fd9", "record_id": "flaws_cloudtrail:0000343:75f769425-a9d6-4a87-b5ca-6bc4236d7fd9", "row_index": 343, "timestamp": "2018-10-29T04:28:27Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 906, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "75f769425-a9d6-4a87-b5ca-6bc4236d7fd9", "eventTime": "2018-10-29T04:28:27Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bf33527f-1b44-40db-9578-6b47b462cbd8", "record_id": "flaws_cloudtrail:0000344:bf33527f-1b44-40db-9578-6b47b462cbd8", "row_index": 344, "timestamp": "2018-10-29T04:28:28Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bf33527f-1b44-40db-9578-6b47b462cbd8", "eventTime": "2018-10-29T04:28:28Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bccbd3fa-f65e-4f42-abf4-29cb2be6d66b", "record_id": "flaws_cloudtrail:0000345:bccbd3fa-f65e-4f42-abf4-29cb2be6d66b", "row_index": 345, "timestamp": "2018-10-29T04:28:29Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bccbd3fa-f65e-4f42-abf4-29cb2be6d66b", "eventTime": "2018-10-29T04:28:29Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dd27bd70-93a9-4cf3-b0d1-265d4f08edf3", "record_id": "flaws_cloudtrail:0000346:dd27bd70-93a9-4cf3-b0d1-265d4f08edf3", "row_index": 346, "timestamp": "2018-10-29T04:28:30Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dd27bd70-93a9-4cf3-b0d1-265d4f08edf3", "eventTime": "2018-10-29T04:28:30Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "05d62a6e-d51f-49b5-b905-7fac71c2af06", "record_id": "flaws_cloudtrail:0000347:05d62a6e-d51f-49b5-b905-7fac71c2af06", "row_index": 347, "timestamp": "2018-10-29T04:28:31Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "05d62a6e-d51f-49b5-b905-7fac71c2af06", "eventTime": "2018-10-29T04:28:31Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d8fb53cd-ee54-438d-b2c3-acba53bfd3ac", "record_id": "flaws_cloudtrail:0000348:d8fb53cd-ee54-438d-b2c3-acba53bfd3ac", "row_index": 348, "timestamp": "2018-10-29T04:28:32Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d8fb53cd-ee54-438d-b2c3-acba53bfd3ac", "eventTime": "2018-10-29T04:28:32Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d3ea5088-bffc-427b-a60e-e281fd5df8b6", "record_id": "flaws_cloudtrail:0000349:d3ea5088-bffc-427b-a60e-e281fd5df8b6", "row_index": 349, "timestamp": "2018-10-29T04:28:33Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d3ea5088-bffc-427b-a60e-e281fd5df8b6", "eventTime": "2018-10-29T04:28:33Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "871503b-2201-43a4-b575-0fe87411eaf3", "record_id": "flaws_cloudtrail:0000350:871503b-2201-43a4-b575-0fe87411eaf3", "row_index": 350, "timestamp": "2018-10-29T04:28:35Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "871503b-2201-43a4-b575-0fe87411eaf3", "eventTime": "2018-10-29T04:28:35Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ffee9a39-1c92-424f-976e-528b6fca7054", "record_id": "flaws_cloudtrail:0000351:ffee9a39-1c92-424f-976e-528b6fca7054", "row_index": 351, "timestamp": "2018-10-29T04:28:36Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ffee9a39-1c92-424f-976e-528b6fca7054", "eventTime": "2018-10-29T04:28:36Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "313501ff-ae68-4c30-90a5-60a815a990436", "record_id": "flaws_cloudtrail:0000352:313501ff-ae68-4c30-90a5-60a815a990436", "row_index": 352, "timestamp": "2018-10-29T04:28:37Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "313501ff-ae68-4c30-90a5-60a815a990436", "eventTime": "2018-10-29T04:28:37Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e3d464e8-8b04-43ee-86fc-a17bdbc9b36f", "record_id": "flaws_cloudtrail:0000353:e3d464e8-8b04-43ee-86fc-a17bdbc9b36f", "row_index": 353, "timestamp": "2018-10-29T04:28:37Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e3d464e8-8b04-43ee-86fc-a17bdbc9b36f", "eventTime": "2018-10-29T04:28:37Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0f9ad4c7-29a7-4952-bdf1-d54cd8c5e187", "record_id": "flaws_cloudtrail:0000354:0f9ad4c7-29a7-4952-bdf1-d54cd8c5e187", "row_index": 354, "timestamp": "2018-10-29T04:28:38Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0f9ad4c7-29a7-4952-bdf1-d54cd8c5e187", "eventTime": "2018-10-29T04:28:38Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ce2bb4db-0f56-4000-9605-0c5a66b650cb", "record_id": "flaws_cloudtrail:0000355:ce2bb4db-0f56-4000-9605-0c5a66b650cb", "row_index": 355, "timestamp": "2018-10-29T04:28:39Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ce2bb4db-0f56-4000-9605-0c5a66b650cb", "eventTime": "2018-10-29T04:28:39Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a97b41fb-b144-4aa2-967f-a7297d73276a", "record_id": "flaws_cloudtrail:0000356:a97b41fb-b144-4aa2-967f-a7297d73276a", "row_index": 356, "timestamp": "2018-10-29T04:28:41Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a97b41fb-b144-4aa2-967f-a7297d73276a", "eventTime": "2018-10-29T04:28:41Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0e5f193a-0298-462c-a856-53fac2b3fce1", "record_id": "flaws_cloudtrail:0000357:0e5f193a-0298-462c-a856-53fac2b3fce1", "row_index": 357, "timestamp": "2018-10-29T04:28:42Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0e5f193a-0298-462c-a856-53fac2b3fce1", "eventTime": "2018-10-29T04:28:42Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "337f4ba6-9669-40d4-9785-1bbee0e985527", "record_id": "flaws_cloudtrail:0000358:337f4ba6-9669-40d4-9785-1bbee0e985527", "row_index": 358, "timestamp": "2018-10-29T04:28:43Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "337f4ba6-9669-40d4-9785-1bbee0e985527", "eventTime": "2018-10-29T04:28:43Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "242721-30f5-4940-9fd2-d49cb8fb0fe8", "record_id": "flaws_cloudtrail:0000359:242721-30f5-4940-9fd2-d49cb8fb0fe8", "row_index": 359, "timestamp": "2018-10-29T04:28:44Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "242721-30f5-4940-9fd2-d49cb8fb0fe8", "eventTime": "2018-10-29T04:28:44Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d770dbda-dc84-4a66-bdef-4ee859d979ed", "record_id": "flaws_cloudtrail:0000360:d770dbda-dc84-4a66-bdef-4ee859d979ed", "row_index": 360, "timestamp": "2018-10-29T04:28:45Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d770dbda-dc84-4a66-bdef-4ee859d979ed", "eventTime": "2018-10-29T04:28:45Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "87c04a83-90a2-4106-bfac-25af499a7ad8", "record_id": "flaws_cloudtrail:0000361:87c04a83-90a2-4106-bfac-25af499a7ad8", "row_index": 361, "timestamp": "2018-10-29T04:28:46Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "87c04a83-90a2-4106-bfac-25af499a7ad8", "eventTime": "2018-10-29T04:28:46Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7c07527-9f9c-4d89-9667-edad1334f08f", "record_id": "flaws_cloudtrail:0000362:7c07527-9f9c-4d89-9667-edad1334f08f", "row_index": 362, "timestamp": "2018-10-29T04:28:47Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 906, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7c07527-9f9c-4d89-9667-edad1334f08f", "eventTime": "2018-10-29T04:28:47Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6f403c83-0623-4cf5-98a6-2c322508", "record_id": "flaws_cloudtrail:0000363:6f403c83-0623-4cf5-98a6-2c322508", "row_index": 363, "timestamp": "2018-10-29T04:28:47Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 905, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6f403c83-0623-4cf5-98a6-2c322508", "eventTime": "2018-10-29T04:28:47Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cce9b6aa-148f-43fc-a5b0-5997caa6dce6", "record_id": "flaws_cloudtrail:0000364:cce9b6aa-148f-43fc-a5b0-5997caa6dce6", "row_index": 364, "timestamp": "2018-10-29T04:28:49Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cce9b6aa-148f-43fc-a5b0-5997caa6dce6", "eventTime": "2018-10-29T04:28:49Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ca77d525-8e0d-4536-adc2-d00b7d6e7812", "record_id": "flaws_cloudtrail:0000365:ca77d525-8e0d-4536-adc2-d00b7d6e7812", "row_index": 365, "timestamp": "2018-10-29T04:28:49Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ca77d525-8e0d-4536-adc2-d00b7d6e7812", "eventTime": "2018-10-29T04:28:49Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "863eb1df-cb24-4f83-92ae-da591340c678", "record_id": "flaws_cloudtrail:0000366:863eb1df-cb24-4f83-92ae-da591340c678", "row_index": 366, "timestamp": "2018-10-29T04:28:50Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "863eb1df-cb24-4f83-92ae-da591340c678", "eventTime": "2018-10-29T04:28:50Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "22cfa26a-8bf1-4ea7-8fd3-c0a85f696362c", "record_id": "flaws_cloudtrail:0000367:22cfa26a-8bf1-4ea7-8fd3-c0a85f696362c", "row_index": 367, "timestamp": "2018-10-29T04:28:51Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "22cfa26a-8bf1-4ea7-8fd3-c0a85f696362c", "eventTime": "2018-10-29T04:28:51Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "317441-c8b0-49dd-be4e-e3839f03cf41", "record_id": "flaws_cloudtrail:0000368:317441-c8b0-49dd-be4e-e3839f03cf41", "row_index": 368, "timestamp": "2018-10-29T04:28:52Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "317441-c8b0-49dd-be4e-e3839f03cf41", "eventTime": "2018-10-29T04:28:52Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d807366d5-a79e-484b-9c0b-29dbb65eebd5", "record_id": "flaws_cloudtrail:0000369:d807366d5-a79e-484b-9c0b-29dbb65eebd5", "row_index": 369, "timestamp": "2018-10-29T04:28:53Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d807366d5-a79e-484b-9c0b-29dbb65eebd5", "eventTime": "2018-10-29T04:28:53Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "59aaecaf-1641-4ad7-b6fa-d106409f4c60", "record_id": "flaws_cloudtrail:0000370:59aaecaf-1641-4ad7-b6fa-d106409f4c60", "row_index": 370, "timestamp": "2018-10-29T04:28:54Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "59aaecaf-1641-4ad7-b6fa-d106409f4c60", "eventTime": "2018-10-29T04:28:54Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4755e47c-76fb-4dfc-a16b-876c8dda5eb1", "record_id": "flaws_cloudtrail:0000371:4755e47c-76fb-4dfc-a16b-876c8dda5eb1", "row_index": 371, "timestamp": "2018-10-29T04:28:55Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4755e47c-76fb-4dfc-a16b-876c8dda5eb1", "eventTime": "2018-10-29T04:28:55Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b2b7d62d-1255-4e1a-8bb2-78c8d76a45cf", "record_id": "flaws_cloudtrail:0000372:b2b7d62d-1255-4e1a-8bb2-78c8d76a45cf", "row_index": 372, "timestamp": "2018-10-29T04:28:56Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b2b7d62d-1255-4e1a-8bb2-78c8d76a45cf", "eventTime": "2018-10-29T04:28:56Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c341250-d7f7-47b8-a9e2-ff02eff77ab2", "record_id": "flaws_cloudtrail:0000373:c341250-d7f7-47b8-a9e2-ff02eff77ab2", "row_index": 373, "timestamp": "2018-10-29T04:28:56Z", "event_type": "GetPolicy202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "16.9.0.4", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 695, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c341250-d7f7-47b8-a9e2-ff02eff77ab2", "eventTime": "2018-10-29T04:28:56Z", "eventName": "GetPolicy202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.9.0.4", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"functionName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cff8f10a-03ea-45b4-9b0a-a2a0f2ab1f43", "record_id": "flaws_cloudtrail:0000374:cff8f10a-03ea-45b4-9b0a-a2a0f2ab1f43", "row_index": 374, "timestamp": "2018-10-29T04:28:57Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cff8f10a-03ea-45b4-9b0a-a2a0f2ab1f43", "eventTime": "2018-10-29T04:28:57Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fe32868-6ce4-4423-bcdb-f686f374f795", "record_id": "flaws_cloudtrail:0000375:fe32868-6ce4-4423-bcdb-f686f374f795", "row_index": 375, "timestamp": "2018-10-29T04:28:57Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fe32868-6ce4-4423-bcdb-f686f374f795", "eventTime": "2018-10-29T04:28:57Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ae07630d-7978-4bc9-bff4-877090a8281f5", "record_id": "flaws_cloudtrail:0000376:ae07630d-7978-4bc9-bff4-877090a8281f5", "row_index": 376, "timestamp": "2018-10-29T04:28:58Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ae07630d-7978-4bc9-bff4-877090a8281f5", "eventTime": "2018-10-29T04:28:58Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "18b8e003-1316-46df-a37b-e58719240311", "record_id": "flaws_cloudtrail:0000377:18b8e003-1316-46df-a37b-e58719240311", "row_index": 377, "timestamp": "2018-10-29T04:28:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "18b8e003-1316-46df-a37b-e58719240311", "eventTime": "2018-10-29T04:28:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3123fe74-3353-4f01-b878-e337a91e0ad3", "record_id": "flaws_cloudtrail:0000378:3123fe74-3353-4f01-b878-e337a91e0ad3", "row_index": 378, "timestamp": "2018-10-29T04:29:00Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3123fe74-3353-4f01-b878-e337a91e0ad3", "eventTime": "2018-10-29T04:29:00Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "17bb9061-429f-4b90-b48d-b734ed6c2e42", "record_id": "flaws_cloudtrail:0000379:17bb9061-429f-4b90-b48d-b734ed6c2e42", "row_index": 379, "timestamp": "2018-10-29T04:29:01Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "17bb9061-429f-4b90-b48d-b734ed6c2e42", "eventTime": "2018-10-29T04:29:01Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8ebc8f5c-f9f9-40b4-b9c9-ac6a24f08bb6", "record_id": "flaws_cloudtrail:0000380:8ebc8f5c-f9f9-40b4-b9c9-ac6a24f08bb6", "row_index": 380, "timestamp": "2018-10-29T04:29:02Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8ebc8f5c-f9f9-40b4-b9c9-ac6a24f08bb6", "eventTime": "2018-10-29T04:29:02Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "78554f44-3b9c-4a83-a942-3b003c0b385c", "record_id": "flaws_cloudtrail:0000381:78554f44-3b9c-4a83-a942-3b003c0b385c", "row_index": 381, "timestamp": "2018-10-29T04:29:02Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "78554f44-3b9c-4a83-a942-3b003c0b385c", "eventTime": "2018-10-29T04:29:02Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "978247f67-ef94-437c-9413-70a88b3d357e", "record_id": "flaws_cloudtrail:0000382:978247f67-ef94-437c-9413-70a88b3d357e", "row_index": 382, "timestamp": "2018-10-29T04:29:03Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "978247f67-ef94-437c-9413-70a88b3d357e", "eventTime": "2018-10-29T04:29:03Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "45d249b6-e79a-4ea6-9a65-576f74df1293", "record_id": "flaws_cloudtrail:0000383:45d249b6-e79a-4ea6-9a65-576f74df1293", "row_index": 383, "timestamp": "2018-10-29T04:29:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "45d249b6-e79a-4ea6-9a65-576f74df1293", "eventTime": "2018-10-29T04:29:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b7f54217-031b-4190-beea-b1b1136dc61d", "record_id": "flaws_cloudtrail:0000384:b7f54217-031b-4190-beea-b1b1136dc61d", "row_index": 384, "timestamp": "2018-10-29T04:29:05Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b7f54217-031b-4190-beea-b1b1136dc61d", "eventTime": "2018-10-29T04:29:05Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1885e56f-d9b6-4399-aea2-9406d76133bc", "record_id": "flaws_cloudtrail:0000385:1885e56f-d9b6-4399-aea2-9406d76133bc", "row_index": 385, "timestamp": "2018-10-29T04:29:06Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1885e56f-d9b6-4399-aea2-9406d76133bc", "eventTime": "2018-10-29T04:29:06Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "46894d7b-7583-4883-95cb-4c2ab3a9bd77", "record_id": "flaws_cloudtrail:0000386:46894d7b-7583-4883-95cb-4c2ab3a9bd77", "row_index": 386, "timestamp": "2018-10-29T04:29:07Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "46894d7b-7583-4883-95cb-4c2ab3a9bd77", "eventTime": "2018-10-29T04:29:07Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "596f6dbb-f23e-48bd-9a37-49dc199bcbd9", "record_id": "flaws_cloudtrail:0000387:596f6dbb-f23e-48bd-9a37-49dc199bcbd9", "row_index": 387, "timestamp": "2018-10-29T04:29:08Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "596f6dbb-f23e-48bd-9a37-49dc199bcbd9", "eventTime": "2018-10-29T04:29:08Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "52f16208-1e7f-4fbf-bd73-9a624ca1c79f", "record_id": "flaws_cloudtrail:0000388:52f16208-1e7f-4fbf-bd73-9a624ca1c79f", "row_index": 388, "timestamp": "2018-10-29T04:29:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "52f16208-1e7f-4fbf-bd73-9a624ca1c79f", "eventTime": "2018-10-29T04:29:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6ab8551f-eb04-4035-bb08-fe28136a932", "record_id": "flaws_cloudtrail:0000389:6ab8551f-eb04-4035-bb08-fe28136a932", "row_index": 389, "timestamp": "2018-10-29T04:29:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6ab8551f-eb04-4035-bb08-fe28136a932", "eventTime": "2018-10-29T04:29:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1a6bcb90-2a95-4105-b6c4-db8a47630a", "record_id": "flaws_cloudtrail:0000390:1a6bcb90-2a95-4105-b6c4-db8a47630a", "row_index": 390, "timestamp": "2018-10-29T04:29:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1a6bcb90-2a95-4105-b6c4-db8a47630a", "eventTime": "2018-10-29T04:29:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "73ae268c-2176-48d0-aecc-7c02c78e20b4", "record_id": "flaws_cloudtrail:0000391:73ae268c-2176-48d0-aecc-7c02c78e20b4", "row_index": 391, "timestamp": "2018-10-29T04:29:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "73ae268c-2176-48d0-aecc-7c02c78e20b4", "eventTime": "2018-10-29T04:29:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "167ed498-473a-487a-a069-ca067858fcf12", "record_id": "flaws_cloudtrail:0000392:167ed498-473a-487a-a069-ca067858fcf12", "row_index": 392, "timestamp": "2018-10-29T04:29:14Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 911, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "167ed498-473a-487a-a069-ca067858fcf12", "eventTime": "2018-10-29T04:29:14Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "42988cd1-cb5d-4d4c-99c1-b6cb007d68b2", "record_id": "flaws_cloudtrail:0000393:42988cd1-cb5d-4d4c-99c1-b6cb007d68b2", "row_index": 393, "timestamp": "2018-10-29T04:29:14Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "42988cd1-cb5d-4d4c-99c1-b6cb007d68b2", "eventTime": "2018-10-29T04:29:14Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "83ba282c-727a-4be0-b8ba-1146e9d8d44f", "record_id": "flaws_cloudtrail:0000394:83ba282c-727a-4be0-b8ba-1146e9d8d44f", "row_index": 394, "timestamp": "2018-10-29T04:29:15Z", "event_type": "ListFunctions202224", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.96.24.205", "user_agent": "aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 685, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "83ba282c-727a-4be0-b8ba-1146e9d8d44f", "eventTime": "2018-10-29T04:29:15Z", "eventName": "ListFunctions202224", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.96.24.205", "userAgent": "aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0cb8800d-a02b-404c-b532-194b6c545bbb", "record_id": "flaws_cloudtrail:0000395:0cb8800d-a02b-404c-b532-194b6c545bbb", "row_index": 395, "timestamp": "2018-10-29T04:29:16Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0cb8800d-a02b-404c-b532-194b6c545bbb", "eventTime": "2018-10-29T04:29:16Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8693cffc-3ed3-44bd-8b6c-d61141d0effd", "record_id": "flaws_cloudtrail:0000396:8693cffc-3ed3-44bd-8b6c-d61141d0effd", "row_index": 396, "timestamp": "2018-10-29T04:29:17Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8693cffc-3ed3-44bd-8b6c-d61141d0effd", "eventTime": "2018-10-29T04:29:17Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f33cd9a4-4f7a-49af-8565-5618dafb4893", "record_id": "flaws_cloudtrail:0000397:f33cd9a4-4f7a-49af-8565-5618dafb4893", "row_index": 397, "timestamp": "2018-10-29T04:29:17Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f33cd9a4-4f7a-49af-8565-5618dafb4893", "eventTime": "2018-10-29T04:29:17Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f1b330986-cec3-493f-8506-7c0272a4adf4", "record_id": "flaws_cloudtrail:0000398:f1b330986-cec3-493f-8506-7c0272a4adf4", "row_index": 398, "timestamp": "2018-10-29T04:29:18Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f1b330986-cec3-493f-8506-7c0272a4adf4", "eventTime": "2018-10-29T04:29:18Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e9c2d683-9c6d-4de2-aa38-019ed9a5528f", "record_id": "flaws_cloudtrail:0000399:e9c2d683-9c6d-4de2-aa38-019ed9a5528f", "row_index": 399, "timestamp": "2018-10-29T04:29:19Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e9c2d683-9c6d-4de2-aa38-019ed9a5528f", "eventTime": "2018-10-29T04:29:19Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4e89222-33cf-4dcc-be6b-35ea3b8b2ffc", "record_id": "flaws_cloudtrail:0000400:4e89222-33cf-4dcc-be6b-35ea3b8b2ffc", "row_index": 400, "timestamp": "2018-10-29T04:29:20Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4e89222-33cf-4dcc-be6b-35ea3b8b2ffc", "eventTime": "2018-10-29T04:29:20Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7f9a5b4f-497c-45e8-a267-bc4b80f31cba", "record_id": "flaws_cloudtrail:0000401:7f9a5b4f-497c-45e8-a267-bc4b80f31cba", "row_index": 401, "timestamp": "2018-10-29T04:29:21Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7f9a5b4f-497c-45e8-a267-bc4b80f31cba", "eventTime": "2018-10-29T04:29:21Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1584bdc3-972e-4c31-a9ce-23e4420cddff", "record_id": "flaws_cloudtrail:0000402:1584bdc3-972e-4c31-a9ce-23e4420cddff", "row_index": 402, "timestamp": "2018-10-29T04:29:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1584bdc3-972e-4c31-a9ce-23e4420cddff", "eventTime": "2018-10-29T04:29:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "774765c73-0e2e-4d5b-8062-65c0cb861220e", "record_id": "flaws_cloudtrail:0000403:774765c73-0e2e-4d5b-8062-65c0cb861220e", "row_index": 403, "timestamp": "2018-10-29T04:29:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "774765c73-0e2e-4d5b-8062-65c0cb861220e", "eventTime": "2018-10-29T04:29:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a1e840a7-0d30-4fca-804c-8896bcf2c019", "record_id": "flaws_cloudtrail:0000404:a1e840a7-0d30-4fca-804c-8896bcf2c019", "row_index": 404, "timestamp": "2018-10-29T04:29:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a1e840a7-0d30-4fca-804c-8896bcf2c019", "eventTime": "2018-10-29T04:29:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a06f88c8-b972-4041-91cd-290481e905eb", "record_id": "flaws_cloudtrail:0000405:a06f88c8-b972-4041-91cd-290481e905eb", "row_index": 405, "timestamp": "2018-10-29T04:29:24Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a06f88c8-b972-4041-91cd-290481e905eb", "eventTime": "2018-10-29T04:29:24Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3e2d2145-7559-4bcf-b020-78032f8ad", "record_id": "flaws_cloudtrail:0000406:3e2d2145-7559-4bcf-b020-78032f8ad", "row_index": 406, "timestamp": "2018-10-29T04:29:25Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 906, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3e2d2145-7559-4bcf-b020-78032f8ad", "eventTime": "2018-10-29T04:29:25Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8bed1821-2202-4ffd-a3a1-ba16f4cd9faa", "record_id": "flaws_cloudtrail:0000407:8bed1821-2202-4ffd-a3a1-ba16f4cd9faa", "row_index": 407, "timestamp": "2018-10-29T04:29:26Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8bed1821-2202-4ffd-a3a1-ba16f4cd9faa", "eventTime": "2018-10-29T04:29:26Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0ef39b3c-671e-4e14-b57a-8249fbc72f22", "record_id": "flaws_cloudtrail:0000408:0ef39b3c-671e-4e14-b57a-8249fbc72f22", "row_index": 408, "timestamp": "2018-10-29T04:29:27Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0ef39b3c-671e-4e14-b57a-8249fbc72f22", "eventTime": "2018-10-29T04:29:27Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8effd6ac-45e4-403e-a0b8-f5ef04253", "record_id": "flaws_cloudtrail:0000409:8effd6ac-45e4-403e-a0b8-f5ef04253", "row_index": 409, "timestamp": "2018-10-29T04:29:27Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 906, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8effd6ac-45e4-403e-a0b8-f5ef04253", "eventTime": "2018-10-29T04:29:27Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b8c782309-d57b-4e8a-9e2b-40ec1313c911", "record_id": "flaws_cloudtrail:0000410:b8c782309-d57b-4e8a-9e2b-40ec1313c911", "row_index": 410, "timestamp": "2018-10-29T04:29:28Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b8c782309-d57b-4e8a-9e2b-40ec1313c911", "eventTime": "2018-10-29T04:29:28Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "53c8603b-8134-4f3b-83c0-9ba8cad98cec", "record_id": "flaws_cloudtrail:0000411:53c8603b-8134-4f3b-83c0-9ba8cad98cec", "row_index": 411, "timestamp": "2018-10-29T04:29:29Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "53c8603b-8134-4f3b-83c0-9ba8cad98cec", "eventTime": "2018-10-29T04:29:29Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "421474e01-dcc8-4750-8758-13331fe1df1d", "record_id": "flaws_cloudtrail:0000412:421474e01-dcc8-4750-8758-13331fe1df1d", "row_index": 412, "timestamp": "2018-10-29T04:29:30Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "421474e01-dcc8-4750-8758-13331fe1df1d", "eventTime": "2018-10-29T04:29:30Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "16668cc1-8fcf-4f3d-a90a-d5cc3030680c", "record_id": "flaws_cloudtrail:0000413:16668cc1-8fcf-4f3d-a90a-d5cc3030680c", "row_index": 413, "timestamp": "2018-10-29T04:29:31Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "16668cc1-8fcf-4f3d-a90a-d5cc3030680c", "eventTime": "2018-10-29T04:29:31Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bb2c1c83-0ce4-4d7d-b8c3-b33c6f1d1b43", "record_id": "flaws_cloudtrail:0000414:bb2c1c83-0ce4-4d7d-b8c3-b33c6f1d1b43", "row_index": 414, "timestamp": "2018-10-29T04:29:32Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bb2c1c83-0ce4-4d7d-b8c3-b33c6f1d1b43", "eventTime": "2018-10-29T04:29:32Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b3582e57-fd02-4cc6-bcf7-1b04dd7ac757", "record_id": "flaws_cloudtrail:0000415:b3582e57-fd02-4cc6-bcf7-1b04dd7ac757", "row_index": 415, "timestamp": "2018-10-29T04:29:33Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b3582e57-fd02-4cc6-bcf7-1b04dd7ac757", "eventTime": "2018-10-29T04:29:33Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c495819a7-a984-4792-a4e7-9ab8426a9021", "record_id": "flaws_cloudtrail:0000416:c495819a7-a984-4792-a4e7-9ab8426a9021", "row_index": 416, "timestamp": "2018-10-29T04:29:34Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c495819a7-a984-4792-a4e7-9ab8426a9021", "eventTime": "2018-10-29T04:29:34Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "eaa44f1b-299c-4643-9751-1469b0f0d2f4", "record_id": "flaws_cloudtrail:0000417:eaa44f1b-299c-4643-9751-1469b0f0d2f4", "row_index": 417, "timestamp": "2018-10-29T04:29:35Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "eaa44f1b-299c-4643-9751-1469b0f0d2f4", "eventTime": "2018-10-29T04:29:35Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7fb00497-5f2d-4184-9821-e252561", "record_id": "flaws_cloudtrail:0000418:7fb00497-5f2d-4184-9821-e252561", "row_index": 418, "timestamp": "2018-10-29T04:29:36Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 904, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7fb00497-5f2d-4184-9821-e252561", "eventTime": "2018-10-29T04:29:36Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7460db57-49e5-4a9e-b9ab-19d4c20de308", "record_id": "flaws_cloudtrail:0000419:7460db57-49e5-4a9e-b9ab-19d4c20de308", "row_index": 419, "timestamp": "2018-10-29T04:29:37Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7460db57-49e5-4a9e-b9ab-19d4c20de308", "eventTime": "2018-10-29T04:29:37Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "40b795531-0db5-48bc-b129-b957fb8c809c", "record_id": "flaws_cloudtrail:0000420:40b795531-0db5-48bc-b129-b957fb8c809c", "row_index": 420, "timestamp": "2018-10-29T04:29:37Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "40b795531-0db5-48bc-b129-b957fb8c809c", "eventTime": "2018-10-29T04:29:37Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c35d32d6-9e29-49c6-8074-97bb5c94be61", "record_id": "flaws_cloudtrail:0000421:c35d32d6-9e29-49c6-8074-97bb5c94be61", "row_index": 421, "timestamp": "2018-10-29T04:29:38Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c35d32d6-9e29-49c6-8074-97bb5c94be61", "eventTime": "2018-10-29T04:29:38Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d308c29c-5be2-4959-8b72-4bd1b5bfc1d3", "record_id": "flaws_cloudtrail:0000422:d308c29c-5be2-4959-8b72-4bd1b5bfc1d3", "row_index": 422, "timestamp": "2018-10-29T04:29:39Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d308c29c-5be2-4959-8b72-4bd1b5bfc1d3", "eventTime": "2018-10-29T04:29:39Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2ac04463-4894-403d-aa9d-26502c60935f", "record_id": "flaws_cloudtrail:0000423:2ac04463-4894-403d-aa9d-26502c60935f", "row_index": 423, "timestamp": "2018-10-29T04:29:50Z", "event_type": "GetPolicy202224v2", "event_source": "lambda.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.96.24.205", "user_agent": "aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 703, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2ac04463-4894-403d-aa9d-26502c60935f", "eventTime": "2018-10-29T04:29:50Z", "eventName": "GetPolicy202224v2", "eventSource": "lambda.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.96.24.205", "userAgent": "aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"functionName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cb9d751c-4091-4e2a-97b4-3ead5446ae8f", "record_id": "flaws_cloudtrail:0000424:cb9d751c-4091-4e2a-97b4-3ead5446ae8f", "row_index": 424, "timestamp": "2018-10-29T04:30:37Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "16.9.0.4", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 838, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cb9d751c-4091-4e2a-97b4-3ead5446ae8f", "eventTime": "2018-10-29T04:30:37Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.9.0.4", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "awsRegion": "us-west-2", "errorCode": "NotFoundException", "errorMessage": "Invalid REST API identifier specified 811596193553:s33ppyapa75", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppyapa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bdef411f-b3e3-4109-93b4-98c381dbd365", "record_id": "flaws_cloudtrail:0000425:bdef411f-b3e3-4109-93b4-98c381dbd365", "row_index": 425, "timestamp": "2018-10-29T04:30:46Z", "event_type": "GetUser", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 655, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bdef411f-b3e3-4109-93b4-98c381dbd365", "eventTime": "2018-10-29T04:30:46Z", "eventName": "GetUser", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "128a2c4e-354e-417a-94af-dd7962301258", "record_id": "flaws_cloudtrail:0000426:128a2c4e-354e-417a-94af-dd7962301258", "row_index": 426, "timestamp": "2018-10-29T04:30:46Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "128a2c4e-354e-417a-94af-dd7962301258", "eventTime": "2018-10-29T04:30:46Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6f08d93e-2dac-403e-bcc3-9dcc2ba60484", "record_id": "flaws_cloudtrail:0000427:6f08d93e-2dac-403e-bcc3-9dcc2ba60484", "row_index": 427, "timestamp": "2018-10-29T04:30:46Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6f08d93e-2dac-403e-bcc3-9dcc2ba60484", "eventTime": "2018-10-29T04:30:46Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7dbaffd4-fc9d-4625-80b7-aba7a29e8533", "record_id": "flaws_cloudtrail:0000428:7dbaffd4-fc9d-4625-80b7-aba7a29e8533", "row_index": 428, "timestamp": "2018-10-29T04:30:46Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7dbaffd4-fc9d-4625-80b7-aba7a29e8533", "eventTime": "2018-10-29T04:30:46Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "de29c5a5-85fa-451e-9c11-de97505a51d0", "record_id": "flaws_cloudtrail:0000429:de29c5a5-85fa-451e-9c11-de97505a51d0", "row_index": 429, "timestamp": "2018-10-29T04:30:47Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "de29c5a5-85fa-451e-9c11-de97505a51d0", "eventTime": "2018-10-29T04:30:47Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "88d666e7-15bc-4e9f-9012-19e2322e948a", "record_id": "flaws_cloudtrail:0000430:88d666e7-15bc-4e9f-9012-19e2322e948a", "row_index": 430, "timestamp": "2018-10-29T04:30:48Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "88d666e7-15bc-4e9f-9012-19e2322e948a", "eventTime": "2018-10-29T04:30:48Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e97d02f2-411b-44bb-9db1-b84d888bbffc", "record_id": "flaws_cloudtrail:0000431:e97d02f2-411b-44bb-9db1-b84d888bbffc", "row_index": 431, "timestamp": "2018-10-29T04:30:49Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e97d02f2-411b-44bb-9db1-b84d888bbffc", "eventTime": "2018-10-29T04:30:49Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a7a19c9c-1174-4ab9-9609-1187f0646efb", "record_id": "flaws_cloudtrail:0000432:a7a19c9c-1174-4ab9-9609-1187f0646efb", "row_index": 432, "timestamp": "2018-10-29T04:30:50Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a7a19c9c-1174-4ab9-9609-1187f0646efb", "eventTime": "2018-10-29T04:30:50Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "11b17f65-2e60-4980-931d-e72abe86cb7d", "record_id": "flaws_cloudtrail:0000433:11b17f65-2e60-4980-931d-e72abe86cb7d", "row_index": 433, "timestamp": "2018-10-29T04:30:51Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "11b17f65-2e60-4980-931d-e72abe86cb7d", "eventTime": "2018-10-29T04:30:51Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "33d783ac-bfb3-4097-90ec-144ebb6d5db9", "record_id": "flaws_cloudtrail:0000434:33d783ac-bfb3-4097-90ec-144ebb6d5db9", "row_index": 434, "timestamp": "2018-10-29T04:30:52Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "33d783ac-bfb3-4097-90ec-144ebb6d5db9", "eventTime": "2018-10-29T04:30:52Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dcac8f41-d69e-4505-a242-3d7082edd321", "record_id": "flaws_cloudtrail:0000435:dcac8f41-d69e-4505-a242-3d7082edd321", "row_index": 435, "timestamp": "2018-10-29T04:30:53Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dcac8f41-d69e-4505-a242-3d7082edd321", "eventTime": "2018-10-29T04:30:53Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "686539-9b03-4c48-9d70-36956fdd1b2", "record_id": "flaws_cloudtrail:0000436:686539-9b03-4c48-9d70-36956fdd1b2", "row_index": 436, "timestamp": "2018-10-29T04:30:54Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 906, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "686539-9b03-4c48-9d70-36956fdd1b2", "eventTime": "2018-10-29T04:30:54Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "14c61b5a-1d2d-485b-9c3d-17ca94f918d6", "record_id": "flaws_cloudtrail:0000437:14c61b5a-1d2d-485b-9c3d-17ca94f918d6", "row_index": 437, "timestamp": "2018-10-29T04:30:55Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "14c61b5a-1d2d-485b-9c3d-17ca94f918d6", "eventTime": "2018-10-29T04:30:55Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ffaf3188-a397-45e6-9c63-eb79d59b18d6", "record_id": "flaws_cloudtrail:0000438:ffaf3188-a397-45e6-9c63-eb79d59b18d6", "row_index": 438, "timestamp": "2018-10-29T04:30:56Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ffaf3188-a397-45e6-9c63-eb79d59b18d6", "eventTime": "2018-10-29T04:30:56Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "448b516d-fe27-45a7-a987-39be18c5f6d3", "record_id": "flaws_cloudtrail:0000439:448b516d-fe27-45a7-a987-39be18c5f6d3", "row_index": 439, "timestamp": "2018-10-29T04:30:56Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "448b516d-fe27-45a7-a987-39be18c5f6d3", "eventTime": "2018-10-29T04:30:56Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ae22cdb3-1fb3-4725-a7bc-4e9adb211517", "record_id": "flaws_cloudtrail:0000440:ae22cdb3-1fb3-4725-a7bc-4e9adb211517", "row_index": 440, "timestamp": "2018-10-29T04:30:57Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ae22cdb3-1fb3-4725-a7bc-4e9adb211517", "eventTime": "2018-10-29T04:30:57Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "604a54a7-94f4-4903-9aa2-7b3d35377c2d", "record_id": "flaws_cloudtrail:0000441:604a54a7-94f4-4903-9aa2-7b3d35377c2d", "row_index": 441, "timestamp": "2018-10-29T04:30:58Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "604a54a7-94f4-4903-9aa2-7b3d35377c2d", "eventTime": "2018-10-29T04:30:58Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "da6a9bc5-30d9-4b15-bc41-342947bf4", "record_id": "flaws_cloudtrail:0000442:da6a9bc5-30d9-4b15-bc41-342947bf4", "row_index": 442, "timestamp": "2018-10-29T04:30:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 906, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "da6a9bc5-30d9-4b15-bc41-342947bf4", "eventTime": "2018-10-29T04:30:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "172692d09-068d-4045-9688-37700b4e", "record_id": "flaws_cloudtrail:0000443:172692d09-068d-4045-9688-37700b4e", "row_index": 443, "timestamp": "2018-10-29T04:31:00Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 906, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "172692d09-068d-4045-9688-37700b4e", "eventTime": "2018-10-29T04:31:00Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "69d8742f-ea9c-4ce5-97dd-af808ecba03d", "record_id": "flaws_cloudtrail:0000444:69d8742f-ea9c-4ce5-97dd-af808ecba03d", "row_index": 444, "timestamp": "2018-10-29T04:31:01Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "69d8742f-ea9c-4ce5-97dd-af808ecba03d", "eventTime": "2018-10-29T04:31:01Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "60e2a12d-a788-4ef2-b629-4306a0c11c33", "record_id": "flaws_cloudtrail:0000445:60e2a12d-a788-4ef2-b629-4306a0c11c33", "row_index": 445, "timestamp": "2018-10-29T04:31:02Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "60e2a12d-a788-4ef2-b629-4306a0c11c33", "eventTime": "2018-10-29T04:31:02Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "58bd1e87-7d20-4f7e-81c5-3e4fd77705e", "record_id": "flaws_cloudtrail:0000446:58bd1e87-7d20-4f7e-81c5-3e4fd77705e", "row_index": 446, "timestamp": "2018-10-29T04:31:03Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "58bd1e87-7d20-4f7e-81c5-3e4fd77705e", "eventTime": "2018-10-29T04:31:03Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "038a9c51-0c84-4876-9e29-856ea6c1beda", "record_id": "flaws_cloudtrail:0000447:038a9c51-0c84-4876-9e29-856ea6c1beda", "row_index": 447, "timestamp": "2018-10-29T04:31:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "038a9c51-0c84-4876-9e29-856ea6c1beda", "eventTime": "2018-10-29T04:31:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c2acecdb-7695-42ce-978a-c11c20183a04", "record_id": "flaws_cloudtrail:0000448:c2acecdb-7695-42ce-978a-c11c20183a04", "row_index": 448, "timestamp": "2018-10-29T04:31:06Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c2acecdb-7695-42ce-978a-c11c20183a04", "eventTime": "2018-10-29T04:31:06Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7043f6d0-4b4a-419b-b4fe-0b205ca960f5", "record_id": "flaws_cloudtrail:0000449:7043f6d0-4b4a-419b-b4fe-0b205ca960f5", "row_index": 449, "timestamp": "2018-10-29T04:31:07Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7043f6d0-4b4a-419b-b4fe-0b205ca960f5", "eventTime": "2018-10-29T04:31:07Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0248d373-0394-4b5e-aee6-f84aee4ff84c", "record_id": "flaws_cloudtrail:0000450:0248d373-0394-4b5e-aee6-f84aee4ff84c", "row_index": 450, "timestamp": "2018-10-29T04:31:07Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0248d373-0394-4b5e-aee6-f84aee4ff84c", "eventTime": "2018-10-29T04:31:07Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "132c80aa-7c66-4c7e-932a-4fd3c829832e", "record_id": "flaws_cloudtrail:0000451:132c80aa-7c66-4c7e-932a-4fd3c829832e", "row_index": 451, "timestamp": "2018-10-29T04:31:08Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "132c80aa-7c66-4c7e-932a-4fd3c829832e", "eventTime": "2018-10-29T04:31:08Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9b13be2c-8a46-4a3d-a055-6f8b6c247acc", "record_id": "flaws_cloudtrail:0000452:9b13be2c-8a46-4a3d-a055-6f8b6c247acc", "row_index": 452, "timestamp": "2018-10-29T04:31:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9b13be2c-8a46-4a3d-a055-6f8b6c247acc", "eventTime": "2018-10-29T04:31:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "313313a7-f9a1-4223-81ae-713368da0c9c", "record_id": "flaws_cloudtrail:0000453:313313a7-f9a1-4223-81ae-713368da0c9c", "row_index": 453, "timestamp": "2018-10-29T04:31:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "313313a7-f9a1-4223-81ae-713368da0c9c", "eventTime": "2018-10-29T04:31:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f50a30ef-368b-4cbe-a461-0fdbb7fb4e87", "record_id": "flaws_cloudtrail:0000454:f50a30ef-368b-4cbe-a461-0fdbb7fb4e87", "row_index": 454, "timestamp": "2018-10-29T04:31:11Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f50a30ef-368b-4cbe-a461-0fdbb7fb4e87", "eventTime": "2018-10-29T04:31:11Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e938eb68-2637-4fbf-8854-ee36231e554", "record_id": "flaws_cloudtrail:0000455:e938eb68-2637-4fbf-8854-ee36231e554", "row_index": 455, "timestamp": "2018-10-29T04:31:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e938eb68-2637-4fbf-8854-ee36231e554", "eventTime": "2018-10-29T04:31:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4319c776-5d08-4db3-8e51-7e80189d57fc", "record_id": "flaws_cloudtrail:0000456:4319c776-5d08-4db3-8e51-7e80189d57fc", "row_index": 456, "timestamp": "2018-10-29T04:31:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4319c776-5d08-4db3-8e51-7e80189d57fc", "eventTime": "2018-10-29T04:31:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "de7a0013-47f1-4b8b-9331-228adc557a32", "record_id": "flaws_cloudtrail:0000457:de7a0013-47f1-4b8b-9331-228adc557a32", "row_index": 457, "timestamp": "2018-10-29T04:31:14Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "de7a0013-47f1-4b8b-9331-228adc557a32", "eventTime": "2018-10-29T04:31:14Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "893cb632-d0be-460d-a3f1-3d838c7a2168", "record_id": "flaws_cloudtrail:0000458:893cb632-d0be-460d-a3f1-3d838c7a2168", "row_index": 458, "timestamp": "2018-10-29T04:31:15Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "893cb632-d0be-460d-a3f1-3d838c7a2168", "eventTime": "2018-10-29T04:31:15Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "59d149a5-f925-43dc-a62c-d9d587b45aef", "record_id": "flaws_cloudtrail:0000459:59d149a5-f925-43dc-a62c-d9d587b45aef", "row_index": 459, "timestamp": "2018-10-29T04:31:16Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "59d149a5-f925-43dc-a62c-d9d587b45aef", "eventTime": "2018-10-29T04:31:16Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f3ee809d-f918-4433-95b8-f391303e20c6", "record_id": "flaws_cloudtrail:0000460:f3ee809d-f918-4433-95b8-f391303e20c6", "row_index": 460, "timestamp": "2018-10-29T04:31:16Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f3ee809d-f918-4433-95b8-f391303e20c6", "eventTime": "2018-10-29T04:31:16Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d4ae33b8-1a58-49c8-993d-e4a32119d3f7", "record_id": "flaws_cloudtrail:0000461:d4ae33b8-1a58-49c8-993d-e4a32119d3f7", "row_index": 461, "timestamp": "2018-10-29T04:31:17Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d4ae33b8-1a58-49c8-993d-e4a32119d3f7", "eventTime": "2018-10-29T04:31:17Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "530211ed2-06cc-406a-840d-d1ec4ecad493", "record_id": "flaws_cloudtrail:0000462:530211ed2-06cc-406a-840d-d1ec4ecad493", "row_index": 462, "timestamp": "2018-10-29T04:31:18Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "530211ed2-06cc-406a-840d-d1ec4ecad493", "eventTime": "2018-10-29T04:31:18Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cdc42f2d-561b-4227-95dd-410dca2bde24", "record_id": "flaws_cloudtrail:0000463:cdc42f2d-561b-4227-95dd-410dca2bde24", "row_index": 463, "timestamp": "2018-10-29T04:31:19Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cdc42f2d-561b-4227-95dd-410dca2bde24", "eventTime": "2018-10-29T04:31:19Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "72b716b0-8de8-44b4-96d1-1535e57b34ee", "record_id": "flaws_cloudtrail:0000464:72b716b0-8de8-44b4-96d1-1535e57b34ee", "row_index": 464, "timestamp": "2018-10-29T04:31:20Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "72b716b0-8de8-44b4-96d1-1535e57b34ee", "eventTime": "2018-10-29T04:31:20Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e93cf64b-7836-4bf3-b6bf-d06a8716971e", "record_id": "flaws_cloudtrail:0000465:e93cf64b-7836-4bf3-b6bf-d06a8716971e", "row_index": 465, "timestamp": "2018-10-29T04:31:21Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e93cf64b-7836-4bf3-b6bf-d06a8716971e", "eventTime": "2018-10-29T04:31:21Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "add929873-e50f-4e0b-9ec8-b711431a2b306", "record_id": "flaws_cloudtrail:0000466:add929873-e50f-4e0b-9ec8-b711431a2b306", "row_index": 466, "timestamp": "2018-10-29T04:31:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 911, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "add929873-e50f-4e0b-9ec8-b711431a2b306", "eventTime": "2018-10-29T04:31:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "be0682c0-60c2-4fd0-a08e-74e7651ef5dc", "record_id": "flaws_cloudtrail:0000467:be0682c0-60c2-4fd0-a08e-74e7651ef5dc", "row_index": 467, "timestamp": "2018-10-29T04:31:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "be0682c0-60c2-4fd0-a08e-74e7651ef5dc", "eventTime": "2018-10-29T04:31:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "46c2d73f-b488-49bf-8b8e-38f13ab54e3a", "record_id": "flaws_cloudtrail:0000468:46c2d73f-b488-49bf-8b8e-38f13ab54e3a", "row_index": 468, "timestamp": "2018-10-29T04:31:24Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "46c2d73f-b488-49bf-8b8e-38f13ab54e3a", "eventTime": "2018-10-29T04:31:24Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "682d219f-035a-4923-8832-68a6c6d2766f", "record_id": "flaws_cloudtrail:0000469:682d219f-035a-4923-8832-68a6c6d2766f", "row_index": 469, "timestamp": "2018-10-29T04:31:26Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "682d219f-035a-4923-8832-68a6c6d2766f", "eventTime": "2018-10-29T04:31:26Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3eadc834-d419-4ff7-ad73-86c8a093348b", "record_id": "flaws_cloudtrail:0000470:3eadc834-d419-4ff7-ad73-86c8a093348b", "row_index": 470, "timestamp": "2018-10-29T04:31:26Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3eadc834-d419-4ff7-ad73-86c8a093348b", "eventTime": "2018-10-29T04:31:26Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7b8c4311-b5bc-4cf0-b4d9-75003bd87d8", "record_id": "flaws_cloudtrail:0000471:7b8c4311-b5bc-4cf0-b4d9-75003bd87d8", "row_index": 471, "timestamp": "2018-10-29T04:31:27Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7b8c4311-b5bc-4cf0-b4d9-75003bd87d8", "eventTime": "2018-10-29T04:31:27Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "637941d38-d056-42d2-885e-1c73c4b1635c", "record_id": "flaws_cloudtrail:0000472:637941d38-d056-42d2-885e-1c73c4b1635c", "row_index": 472, "timestamp": "2018-10-29T04:31:28Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "637941d38-d056-42d2-885e-1c73c4b1635c", "eventTime": "2018-10-29T04:31:28Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6937c62d-d79b-410f-b07c-23cbe02cf33e", "record_id": "flaws_cloudtrail:0000473:6937c62d-d79b-410f-b07c-23cbe02cf33e", "row_index": 473, "timestamp": "2018-10-29T04:31:28Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6937c62d-d79b-410f-b07c-23cbe02cf33e", "eventTime": "2018-10-29T04:31:28Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "99acfa6a-1e83-41d3-aab5-cc470f2bb1a9", "record_id": "flaws_cloudtrail:0000474:99acfa6a-1e83-41d3-aab5-cc470f2bb1a9", "row_index": 474, "timestamp": "2018-10-29T04:31:29Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "99acfa6a-1e83-41d3-aab5-cc470f2bb1a9", "eventTime": "2018-10-29T04:31:29Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3fe9be17-6925-4122-983a-faa70c340cd5", "record_id": "flaws_cloudtrail:0000475:3fe9be17-6925-4122-983a-faa70c340cd5", "row_index": 475, "timestamp": "2018-10-29T04:31:30Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3fe9be17-6925-4122-983a-faa70c340cd5", "eventTime": "2018-10-29T04:31:30Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5debf69c-8b15-4e25-92e4-5aef22e504741", "record_id": "flaws_cloudtrail:0000476:5debf69c-8b15-4e25-92e4-5aef22e504741", "row_index": 476, "timestamp": "2018-10-29T04:31:31Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5debf69c-8b15-4e25-92e4-5aef22e504741", "eventTime": "2018-10-29T04:31:31Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f66968a5-927a-41bd-a03f-eb7c8cdadba1", "record_id": "flaws_cloudtrail:0000477:f66968a5-927a-41bd-a03f-eb7c8cdadba1", "row_index": 477, "timestamp": "2018-10-29T04:31:32Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f66968a5-927a-41bd-a03f-eb7c8cdadba1", "eventTime": "2018-10-29T04:31:32Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ea353860d-b22b-476a-b4b3-68828d08a74f", "record_id": "flaws_cloudtrail:0000478:ea353860d-b22b-476a-b4b3-68828d08a74f", "row_index": 478, "timestamp": "2018-10-29T04:31:32Z", "event_type": "ListAttachedUserPolicies", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 692, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ea353860d-b22b-476a-b4b3-68828d08a74f", "eventTime": "2018-10-29T04:31:32Z", "eventName": "ListAttachedUserPolicies", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"userName": "Level6"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "99c9694f-d116-487a-a27b-70b8f0e84d1f", "record_id": "flaws_cloudtrail:0000479:99c9694f-d116-487a-a27b-70b8f0e84d1f", "row_index": 479, "timestamp": "2018-10-29T04:31:33Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "99c9694f-d116-487a-a27b-70b8f0e84d1f", "eventTime": "2018-10-29T04:31:33Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "7ec464401-1c9b-486e-916b-ef10f62fab7d", "record_id": "flaws_cloudtrail:0000480:7ec464401-1c9b-486e-916b-ef10f62fab7d", "row_index": 480, "timestamp": "2018-10-29T04:31:34Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "7ec464401-1c9b-486e-916b-ef10f62fab7d", "eventTime": "2018-10-29T04:31:34Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "27d9df21-4dc7-4718-85b8-a39499a3d30d", "record_id": "flaws_cloudtrail:0000481:27d9df21-4dc7-4718-85b8-a39499a3d30d", "row_index": 481, "timestamp": "2018-10-29T04:31:35Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "27d9df21-4dc7-4718-85b8-a39499a3d30d", "eventTime": "2018-10-29T04:31:35Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ac0bd06d-bb49-45e8-8589-5902d38d4046", "record_id": "flaws_cloudtrail:0000482:ac0bd06d-bb49-45e8-8589-5902d38d4046", "row_index": 482, "timestamp": "2018-10-29T04:31:36Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ac0bd06d-bb49-45e8-8589-5902d38d4046", "eventTime": "2018-10-29T04:31:36Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1b4607e6-0dde-4a9f-b6fd-f1bff3f1c7ac", "record_id": "flaws_cloudtrail:0000483:1b4607e6-0dde-4a9f-b6fd-f1bff3f1c7ac", "row_index": 483, "timestamp": "2018-10-29T04:31:36Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1b4607e6-0dde-4a9f-b6fd-f1bff3f1c7ac", "eventTime": "2018-10-29T04:31:36Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0975d11f-6360-429f-9f20-5ec8f750972f", "record_id": "flaws_cloudtrail:0000484:0975d11f-6360-429f-9f20-5ec8f750972f", "row_index": 484, "timestamp": "2018-10-29T04:31:37Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0975d11f-6360-429f-9f20-5ec8f750972f", "eventTime": "2018-10-29T04:31:37Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "048328f3-b4e8-4418-85e7-0d06bbeab3a7", "record_id": "flaws_cloudtrail:0000485:048328f3-b4e8-4418-85e7-0d06bbeab3a7", "row_index": 485, "timestamp": "2018-10-29T04:31:37Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "9.96.24.205", "user_agent": "aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 733, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "048328f3-b4e8-4418-85e7-0d06bbeab3a7", "eventTime": "2018-10-29T04:31:37Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "9.96.24.205", "userAgent": "aws-cli/1.16.8 Python/2.7.12 Linux/4.4.0-53329-Microsoft botocore/1.11.8", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2c4c4797-dc12-42eb-a896-3720a28403bd", "record_id": "flaws_cloudtrail:0000486:2c4c4797-dc12-42eb-a896-3720a28403bd", "row_index": 486, "timestamp": "2018-10-29T04:31:39Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2c4c4797-dc12-42eb-a896-3720a28403bd", "eventTime": "2018-10-29T04:31:39Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c98f92cc-e395-473f-a634-9fb0e3390f74", "record_id": "flaws_cloudtrail:0000487:c98f92cc-e395-473f-a634-9fb0e3390f74", "row_index": 487, "timestamp": "2018-10-29T04:31:40Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c98f92cc-e395-473f-a634-9fb0e3390f74", "eventTime": "2018-10-29T04:31:40Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1cad8664-8399-46e1-92b6-117d03895a5", "record_id": "flaws_cloudtrail:0000488:1cad8664-8399-46e1-92b6-117d03895a5", "row_index": 488, "timestamp": "2018-10-29T04:31:41Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1cad8664-8399-46e1-92b6-117d03895a5", "eventTime": "2018-10-29T04:31:41Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b7eccd2f-5480-4f6f-94da-dfae419e09bb", "record_id": "flaws_cloudtrail:0000489:b7eccd2f-5480-4f6f-94da-dfae419e09bb", "row_index": 489, "timestamp": "2018-10-29T04:31:42Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b7eccd2f-5480-4f6f-94da-dfae419e09bb", "eventTime": "2018-10-29T04:31:42Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "989930c-e588-4a32-ba95-db54415a8147", "record_id": "flaws_cloudtrail:0000490:989930c-e588-4a32-ba95-db54415a8147", "row_index": 490, "timestamp": "2018-10-29T04:31:43Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "989930c-e588-4a32-ba95-db54415a8147", "eventTime": "2018-10-29T04:31:43Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f652d219-1fa7-46c6-b289-03ee6588d383", "record_id": "flaws_cloudtrail:0000491:f652d219-1fa7-46c6-b289-03ee6588d383", "row_index": 491, "timestamp": "2018-10-29T04:31:44Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f652d219-1fa7-46c6-b289-03ee6588d383", "eventTime": "2018-10-29T04:31:44Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "40be6a4c-3341-4863-b5cc-f11bc2770618", "record_id": "flaws_cloudtrail:0000492:40be6a4c-3341-4863-b5cc-f11bc2770618", "row_index": 492, "timestamp": "2018-10-29T04:31:45Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "40be6a4c-3341-4863-b5cc-f11bc2770618", "eventTime": "2018-10-29T04:31:45Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3a2fb4b6-0108-4bbf-a1a5-999b096148b20", "record_id": "flaws_cloudtrail:0000493:3a2fb4b6-0108-4bbf-a1a5-999b096148b20", "row_index": 493, "timestamp": "2018-10-29T04:31:46Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3a2fb4b6-0108-4bbf-a1a5-999b096148b20", "eventTime": "2018-10-29T04:31:46Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "03983fb-63aa-4e65-861e-b4f98872fe4b", "record_id": "flaws_cloudtrail:0000494:03983fb-63aa-4e65-861e-b4f98872fe4b", "row_index": 494, "timestamp": "2018-10-29T04:31:46Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "03983fb-63aa-4e65-861e-b4f98872fe4b", "eventTime": "2018-10-29T04:31:46Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d5d8d53a-857c-44d9-bd68-5ed04e8b2e51", "record_id": "flaws_cloudtrail:0000495:d5d8d53a-857c-44d9-bd68-5ed04e8b2e51", "row_index": 495, "timestamp": "2018-10-29T04:31:47Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d5d8d53a-857c-44d9-bd68-5ed04e8b2e51", "eventTime": "2018-10-29T04:31:47Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "abb3f20a-5747-4a05-b77e-d8635e64f134", "record_id": "flaws_cloudtrail:0000496:abb3f20a-5747-4a05-b77e-d8635e64f134", "row_index": 496, "timestamp": "2018-10-29T04:31:48Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "abb3f20a-5747-4a05-b77e-d8635e64f134", "eventTime": "2018-10-29T04:31:48Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1d824de4-769f-4880-a43f-5b94f1e7399d", "record_id": "flaws_cloudtrail:0000497:1d824de4-769f-4880-a43f-5b94f1e7399d", "row_index": 497, "timestamp": "2018-10-29T04:31:48Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1d824de4-769f-4880-a43f-5b94f1e7399d", "eventTime": "2018-10-29T04:31:48Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2ec0756f-e5ea-4249-ac0f-d6240aad283c", "record_id": "flaws_cloudtrail:0000498:2ec0756f-e5ea-4249-ac0f-d6240aad283c", "row_index": 498, "timestamp": "2018-10-29T04:31:49Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2ec0756f-e5ea-4249-ac0f-d6240aad283c", "eventTime": "2018-10-29T04:31:49Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d59414-f4a1-4dc9-8263-1263efa0b382", "record_id": "flaws_cloudtrail:0000499:d59414-f4a1-4dc9-8263-1263efa0b382", "row_index": 499, "timestamp": "2018-10-29T04:31:50Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d59414-f4a1-4dc9-8263-1263efa0b382", "eventTime": "2018-10-29T04:31:50Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2c30c21c-2f53-43d4-a8a3-9376f6df6391", "record_id": "flaws_cloudtrail:0000500:2c30c21c-2f53-43d4-a8a3-9376f6df6391", "row_index": 500, "timestamp": "2018-10-29T04:31:51Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2c30c21c-2f53-43d4-a8a3-9376f6df6391", "eventTime": "2018-10-29T04:31:51Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "61198-8232-4f07-b692-f94bd206daea", "record_id": "flaws_cloudtrail:0000501:61198-8232-4f07-b692-f94bd206daea", "row_index": 501, "timestamp": "2018-10-29T04:31:52Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 906, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "61198-8232-4f07-b692-f94bd206daea", "eventTime": "2018-10-29T04:31:52Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c176685d8-723a-4e10-8470-e37e8fdc9a25", "record_id": "flaws_cloudtrail:0000502:c176685d8-723a-4e10-8470-e37e8fdc9a25", "row_index": 502, "timestamp": "2018-10-29T04:31:53Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c176685d8-723a-4e10-8470-e37e8fdc9a25", "eventTime": "2018-10-29T04:31:53Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0325b0b2-ba6d-4d21-894c-dfe9d2887014", "record_id": "flaws_cloudtrail:0000503:0325b0b2-ba6d-4d21-894c-dfe9d2887014", "row_index": 503, "timestamp": "2018-10-29T04:31:54Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0325b0b2-ba6d-4d21-894c-dfe9d2887014", "eventTime": "2018-10-29T04:31:54Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3053e559-97fd-4fab-9518-953630936262", "record_id": "flaws_cloudtrail:0000504:3053e559-97fd-4fab-9518-953630936262", "row_index": 504, "timestamp": "2018-10-29T04:31:55Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3053e559-97fd-4fab-9518-953630936262", "eventTime": "2018-10-29T04:31:55Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "99f1dce6-ee20-43f0-9879-a7175dbdd339", "record_id": "flaws_cloudtrail:0000505:99f1dce6-ee20-43f0-9879-a7175dbdd339", "row_index": 505, "timestamp": "2018-10-29T04:31:56Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "99f1dce6-ee20-43f0-9879-a7175dbdd339", "eventTime": "2018-10-29T04:31:56Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b88d55f7-d3d5-436b-867c-1fb87f10714d", "record_id": "flaws_cloudtrail:0000506:b88d55f7-d3d5-436b-867c-1fb87f10714d", "row_index": 506, "timestamp": "2018-10-29T04:31:57Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b88d55f7-d3d5-436b-867c-1fb87f10714d", "eventTime": "2018-10-29T04:31:57Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8ec7e5db-8134-4203-b144-a33aca7377a5", "record_id": "flaws_cloudtrail:0000507:8ec7e5db-8134-4203-b144-a33aca7377a5", "row_index": 507, "timestamp": "2018-10-29T04:31:57Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8ec7e5db-8134-4203-b144-a33aca7377a5", "eventTime": "2018-10-29T04:31:57Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "671f745a-3315-4a41-8f16-c23cc45073db", "record_id": "flaws_cloudtrail:0000508:671f745a-3315-4a41-8f16-c23cc45073db", "row_index": 508, "timestamp": "2018-10-29T04:31:57Z", "event_type": "GetStages", "event_source": "apigateway.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "16.9.0.4", "user_agent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 725, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "readOnly", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "671f745a-3315-4a41-8f16-c23cc45073db", "eventTime": "2018-10-29T04:31:57Z", "eventName": "GetStages", "eventSource": "apigateway.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "16.9.0.4", "userAgent": "aws-cli/1.11.13 Python/3.5.2 Linux/4.4.0-62-generic botocore/1.4.70", "awsRegion": "us-west-2", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"restApiId": "s33ppypa75", "template": false}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "44bcd926-5ab4-42df-bc29-4de40bceff33", "record_id": "flaws_cloudtrail:0000509:44bcd926-5ab4-42df-bc29-4de40bceff33", "row_index": 509, "timestamp": "2018-10-29T04:31:58Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "44bcd926-5ab4-42df-bc29-4de40bceff33", "eventTime": "2018-10-29T04:31:58Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8cb8bce9-a627-4124-8baf-2d49ee2b32ff", "record_id": "flaws_cloudtrail:0000510:8cb8bce9-a627-4124-8baf-2d49ee2b32ff", "row_index": 510, "timestamp": "2018-10-29T04:31:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8cb8bce9-a627-4124-8baf-2d49ee2b32ff", "eventTime": "2018-10-29T04:31:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4ebcd202-0c5d-4578-baff-ef406df19efd", "record_id": "flaws_cloudtrail:0000511:4ebcd202-0c5d-4578-baff-ef406df19efd", "row_index": 511, "timestamp": "2018-10-29T04:32:00Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4ebcd202-0c5d-4578-baff-ef406df19efd", "eventTime": "2018-10-29T04:32:00Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e9524d4e-6e50-47b8-ad29-89f3c21851", "record_id": "flaws_cloudtrail:0000512:e9524d4e-6e50-47b8-ad29-89f3c21851", "row_index": 512, "timestamp": "2018-10-29T04:32:01Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e9524d4e-6e50-47b8-ad29-89f3c21851", "eventTime": "2018-10-29T04:32:01Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d75d852f-d8ac-4340-bd27-66079a60a372", "record_id": "flaws_cloudtrail:0000513:d75d852f-d8ac-4340-bd27-66079a60a372", "row_index": 513, "timestamp": "2018-10-29T04:32:02Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d75d852f-d8ac-4340-bd27-66079a60a372", "eventTime": "2018-10-29T04:32:02Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "bfbe048c-4668-4be1-9f8a-8a1b042e6c04", "record_id": "flaws_cloudtrail:0000514:bfbe048c-4668-4be1-9f8a-8a1b042e6c04", "row_index": 514, "timestamp": "2018-10-29T04:32:03Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "bfbe048c-4668-4be1-9f8a-8a1b042e6c04", "eventTime": "2018-10-29T04:32:03Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d33065d9-abe6-4291-ab9f-6dca4f3f0917", "record_id": "flaws_cloudtrail:0000515:d33065d9-abe6-4291-ab9f-6dca4f3f0917", "row_index": 515, "timestamp": "2018-10-29T04:32:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d33065d9-abe6-4291-ab9f-6dca4f3f0917", "eventTime": "2018-10-29T04:32:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1a91a413-1c16-47c3-9253-107339c169147", "record_id": "flaws_cloudtrail:0000516:1a91a413-1c16-47c3-9253-107339c169147", "row_index": 516, "timestamp": "2018-10-29T04:32:05Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1a91a413-1c16-47c3-9253-107339c169147", "eventTime": "2018-10-29T04:32:05Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "60f44d54-964c-4c56-af6d-d9f982b82c85", "record_id": "flaws_cloudtrail:0000517:60f44d54-964c-4c56-af6d-d9f982b82c85", "row_index": 517, "timestamp": "2018-10-29T04:32:06Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "60f44d54-964c-4c56-af6d-d9f982b82c85", "eventTime": "2018-10-29T04:32:06Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "93a89d44-7098-4636-bcf8-612de26101b7", "record_id": "flaws_cloudtrail:0000518:93a89d44-7098-4636-bcf8-612de26101b7", "row_index": 518, "timestamp": "2018-10-29T04:32:07Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "93a89d44-7098-4636-bcf8-612de26101b7", "eventTime": "2018-10-29T04:32:07Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c8f7af4c-26fb-4f56-8ee1-9ad17560e45", "record_id": "flaws_cloudtrail:0000519:c8f7af4c-26fb-4f56-8ee1-9ad17560e45", "row_index": 519, "timestamp": "2018-10-29T04:32:07Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c8f7af4c-26fb-4f56-8ee1-9ad17560e45", "eventTime": "2018-10-29T04:32:07Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "413ef4ba-a899-42f6-8b7a-daeb4880485e", "record_id": "flaws_cloudtrail:0000520:413ef4ba-a899-42f6-8b7a-daeb4880485e", "row_index": 520, "timestamp": "2018-10-29T04:32:08Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "413ef4ba-a899-42f6-8b7a-daeb4880485e", "eventTime": "2018-10-29T04:32:08Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1d6d319e-ee05-4954-b3c3-94eb961bd25b", "record_id": "flaws_cloudtrail:0000521:1d6d319e-ee05-4954-b3c3-94eb961bd25b", "row_index": 521, "timestamp": "2018-10-29T04:32:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1d6d319e-ee05-4954-b3c3-94eb961bd25b", "eventTime": "2018-10-29T04:32:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "af0759bf-6cf7-403d-9c62-a7a2dfb95e06", "record_id": "flaws_cloudtrail:0000522:af0759bf-6cf7-403d-9c62-a7a2dfb95e06", "row_index": 522, "timestamp": "2018-10-29T04:32:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "af0759bf-6cf7-403d-9c62-a7a2dfb95e06", "eventTime": "2018-10-29T04:32:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3d2fb8ed-d3c5-4489-8082-e14283dba5fc", "record_id": "flaws_cloudtrail:0000523:3d2fb8ed-d3c5-4489-8082-e14283dba5fc", "row_index": 523, "timestamp": "2018-10-29T04:32:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3d2fb8ed-d3c5-4489-8082-e14283dba5fc", "eventTime": "2018-10-29T04:32:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e0384f19-fd48-4329-9d30-cc1d21b16d6a", "record_id": "flaws_cloudtrail:0000524:e0384f19-fd48-4329-9d30-cc1d21b16d6a", "row_index": 524, "timestamp": "2018-10-29T04:32:11Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e0384f19-fd48-4329-9d30-cc1d21b16d6a", "eventTime": "2018-10-29T04:32:11Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "5f1e056d-8f7e-4fd8-ac57-6bd3c2a000c4", "record_id": "flaws_cloudtrail:0000525:5f1e056d-8f7e-4fd8-ac57-6bd3c2a000c4", "row_index": 525, "timestamp": "2018-10-29T04:32:11Z", "event_type": "CreateLogStream", "event_source": "logs.amazonaws.com", "principal": {"type": "AssumedRole", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "account_id": "811596193553", "principal_id": "AROAI4E1FBACLY3FPC6BB:Level6", "user_name": null, "access_key_id": "ASIABGIPC2401M584SH9", "session_issuer_arn": "arn:aws:iam::811596193553:role/service-role/Level6", "session_issuer_user_name": "Level6"}, "network": {"source_ip": "218.210.1.252", "user_agent": "awslambda-worker", "aws_region": "us-west-2"}, "resource_arns": [], "raw_record_size_bytes": 1030, "raw_record_depth": 4, "raw_record_top_level_keys": ["apiVersion", "awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "5f1e056d-8f7e-4fd8-ac57-6bd3c2a000c4", "eventTime": "2018-10-29T04:32:11Z", "eventName": "CreateLogStream", "eventSource": "logs.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "218.210.1.252", "userAgent": "awslambda-worker", "awsRegion": "us-west-2", "userIdentity": {"type": "AssumedRole", "principalId": "AROAI4E1FBACLY3FPC6BB:Level6", "arn": "arn:aws:sts::811596193553:assumed-role/Level6/Level6", "accountId": "811596193553", "accessKeyId": "ASIABGIPC2401M584SH9", "sessionContext": {"attributes": {"mfaAuthenticated": "false", "creationDate": "2018-10-29T02:37:09Z"}, "sessionIssuer": {"type": "Role", "principalId": "AROAI4E1FBACLY3FPC6BB", "arn": "arn:aws:iam::811596193553:role/service-role/Level6", "accountId": "811596193553", "userName": "Level6"}}}, "requestParameters": {"logGroupName": "/aws/lambda/Level6", "logStreamName": "2018/10/29/[$LATEST]fdc7fd012ca90f3ee0be4fe31b9b351c"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e9178dc6-0d59-4990-b41e-4fd15b757bb8", "record_id": "flaws_cloudtrail:0000526:e9178dc6-0d59-4990-b41e-4fd15b757bb8", "row_index": 526, "timestamp": "2018-10-29T04:32:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e9178dc6-0d59-4990-b41e-4fd15b757bb8", "eventTime": "2018-10-29T04:32:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "abff1615-0c3a-4d1d-b126-3cc3eaea7c68", "record_id": "flaws_cloudtrail:0000527:abff1615-0c3a-4d1d-b126-3cc3eaea7c68", "row_index": 527, "timestamp": "2018-10-29T04:32:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "abff1615-0c3a-4d1d-b126-3cc3eaea7c68", "eventTime": "2018-10-29T04:32:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ff7f555c-e00d-41b0-b748-86647ea6b07", "record_id": "flaws_cloudtrail:0000528:ff7f555c-e00d-41b0-b748-86647ea6b07", "row_index": 528, "timestamp": "2018-10-29T04:32:14Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ff7f555c-e00d-41b0-b748-86647ea6b07", "eventTime": "2018-10-29T04:32:14Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "937a143b-8474-4d61-90fd-f36864d5377e", "record_id": "flaws_cloudtrail:0000529:937a143b-8474-4d61-90fd-f36864d5377e", "row_index": 529, "timestamp": "2018-10-29T04:32:15Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "937a143b-8474-4d61-90fd-f36864d5377e", "eventTime": "2018-10-29T04:32:15Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "00fadd11-948f-4e09-8f9d-2a22fc716bc8", "record_id": "flaws_cloudtrail:0000530:00fadd11-948f-4e09-8f9d-2a22fc716bc8", "row_index": 530, "timestamp": "2018-10-29T04:32:16Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "00fadd11-948f-4e09-8f9d-2a22fc716bc8", "eventTime": "2018-10-29T04:32:16Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "21a705f2-5092-491e-8ba5-795f5daab00a", "record_id": "flaws_cloudtrail:0000531:21a705f2-5092-491e-8ba5-795f5daab00a", "row_index": 531, "timestamp": "2018-10-29T04:32:17Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "21a705f2-5092-491e-8ba5-795f5daab00a", "eventTime": "2018-10-29T04:32:17Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c527cd8b-ea5a-4bda-b99e-81a164d87288", "record_id": "flaws_cloudtrail:0000532:c527cd8b-ea5a-4bda-b99e-81a164d87288", "row_index": 532, "timestamp": "2018-10-29T04:32:17Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c527cd8b-ea5a-4bda-b99e-81a164d87288", "eventTime": "2018-10-29T04:32:17Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "718359-d2d1-462a-a9e0-844cc0d46080", "record_id": "flaws_cloudtrail:0000533:718359-d2d1-462a-a9e0-844cc0d46080", "row_index": 533, "timestamp": "2018-10-29T04:32:18Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "718359-d2d1-462a-a9e0-844cc0d46080", "eventTime": "2018-10-29T04:32:18Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b6986cd6-e057-4776-938a-9ea3848a376e", "record_id": "flaws_cloudtrail:0000534:b6986cd6-e057-4776-938a-9ea3848a376e", "row_index": 534, "timestamp": "2018-10-29T04:32:19Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b6986cd6-e057-4776-938a-9ea3848a376e", "eventTime": "2018-10-29T04:32:19Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ffcda2c4-9a5c-45f6-9ecf-d063d2ee79b6", "record_id": "flaws_cloudtrail:0000535:ffcda2c4-9a5c-45f6-9ecf-d063d2ee79b6", "row_index": 535, "timestamp": "2018-10-29T04:32:20Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ffcda2c4-9a5c-45f6-9ecf-d063d2ee79b6", "eventTime": "2018-10-29T04:32:20Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "25133f-054b-48ec-b30c-3bb805b8b62f", "record_id": "flaws_cloudtrail:0000536:25133f-054b-48ec-b30c-3bb805b8b62f", "row_index": 536, "timestamp": "2018-10-29T04:32:21Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "25133f-054b-48ec-b30c-3bb805b8b62f", "eventTime": "2018-10-29T04:32:21Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f88c84b1-7092-4244-8171-d9ecc162baf6", "record_id": "flaws_cloudtrail:0000537:f88c84b1-7092-4244-8171-d9ecc162baf6", "row_index": 537, "timestamp": "2018-10-29T04:32:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f88c84b1-7092-4244-8171-d9ecc162baf6", "eventTime": "2018-10-29T04:32:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b7913bfd-3a57-4c6a-b7d6-c0cc3224bc88", "record_id": "flaws_cloudtrail:0000538:b7913bfd-3a57-4c6a-b7d6-c0cc3224bc88", "row_index": 538, "timestamp": "2018-10-29T04:32:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b7913bfd-3a57-4c6a-b7d6-c0cc3224bc88", "eventTime": "2018-10-29T04:32:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e0353b16-d8c5-443e-ae11-bb08f8e2714e", "record_id": "flaws_cloudtrail:0000539:e0353b16-d8c5-443e-ae11-bb08f8e2714e", "row_index": 539, "timestamp": "2018-10-29T04:32:24Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e0353b16-d8c5-443e-ae11-bb08f8e2714e", "eventTime": "2018-10-29T04:32:24Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2e2783c6-5ca5-4f92-b42b-5cbcf1a1bcf0", "record_id": "flaws_cloudtrail:0000540:2e2783c6-5ca5-4f92-b42b-5cbcf1a1bcf0", "row_index": 540, "timestamp": "2018-10-29T04:32:25Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2e2783c6-5ca5-4f92-b42b-5cbcf1a1bcf0", "eventTime": "2018-10-29T04:32:25Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "849dbfa7-5197-4d4d-be59-c96d72c6fc42", "record_id": "flaws_cloudtrail:0000541:849dbfa7-5197-4d4d-be59-c96d72c6fc42", "row_index": 541, "timestamp": "2018-10-29T04:32:26Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "849dbfa7-5197-4d4d-be59-c96d72c6fc42", "eventTime": "2018-10-29T04:32:26Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "998178-e7de-425e-a4ec-304d24fcf8e6", "record_id": "flaws_cloudtrail:0000542:998178-e7de-425e-a4ec-304d24fcf8e6", "row_index": 542, "timestamp": "2018-10-29T04:32:27Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "998178-e7de-425e-a4ec-304d24fcf8e6", "eventTime": "2018-10-29T04:32:27Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fa865256c-d71f-49aa-a65d-68c871040ab0", "record_id": "flaws_cloudtrail:0000543:fa865256c-d71f-49aa-a65d-68c871040ab0", "row_index": 543, "timestamp": "2018-10-29T04:32:27Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fa865256c-d71f-49aa-a65d-68c871040ab0", "eventTime": "2018-10-29T04:32:27Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "10d8cd83-4934-4478-9d51-8ad66de7f5d7", "record_id": "flaws_cloudtrail:0000544:10d8cd83-4934-4478-9d51-8ad66de7f5d7", "row_index": 544, "timestamp": "2018-10-29T04:32:28Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "10d8cd83-4934-4478-9d51-8ad66de7f5d7", "eventTime": "2018-10-29T04:32:28Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "dc311a56-63df-44ae-834f-481b37308d9e", "record_id": "flaws_cloudtrail:0000545:dc311a56-63df-44ae-834f-481b37308d9e", "row_index": 545, "timestamp": "2018-10-29T04:32:29Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "dc311a56-63df-44ae-834f-481b37308d9e", "eventTime": "2018-10-29T04:32:29Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "09e493db-96d0-413d-aafb-ca880cec79b3", "record_id": "flaws_cloudtrail:0000546:09e493db-96d0-413d-aafb-ca880cec79b3", "row_index": 546, "timestamp": "2018-10-29T04:32:29Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "09e493db-96d0-413d-aafb-ca880cec79b3", "eventTime": "2018-10-29T04:32:29Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d0a8f838-6ba2-414c-b2be-e98fbf06808e", "record_id": "flaws_cloudtrail:0000547:d0a8f838-6ba2-414c-b2be-e98fbf06808e", "row_index": 547, "timestamp": "2018-10-29T04:32:30Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d0a8f838-6ba2-414c-b2be-e98fbf06808e", "eventTime": "2018-10-29T04:32:30Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0629db9f-c1a3-4165-90ce-c3fd8c7cd371", "record_id": "flaws_cloudtrail:0000548:0629db9f-c1a3-4165-90ce-c3fd8c7cd371", "row_index": 548, "timestamp": "2018-10-29T04:32:31Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0629db9f-c1a3-4165-90ce-c3fd8c7cd371", "eventTime": "2018-10-29T04:32:31Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8da78a39-07a4-4f5c-9e92-9640ece314105", "record_id": "flaws_cloudtrail:0000549:8da78a39-07a4-4f5c-9e92-9640ece314105", "row_index": 549, "timestamp": "2018-10-29T04:32:32Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8da78a39-07a4-4f5c-9e92-9640ece314105", "eventTime": "2018-10-29T04:32:32Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e054a5e2-45f1-49de-a22d-79eddcbd5f91", "record_id": "flaws_cloudtrail:0000550:e054a5e2-45f1-49de-a22d-79eddcbd5f91", "row_index": 550, "timestamp": "2018-10-29T04:32:33Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e054a5e2-45f1-49de-a22d-79eddcbd5f91", "eventTime": "2018-10-29T04:32:33Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "59fea09a-d5ae-4c45-9a79-8f0a41bde3f5", "record_id": "flaws_cloudtrail:0000551:59fea09a-d5ae-4c45-9a79-8f0a41bde3f5", "row_index": 551, "timestamp": "2018-10-29T04:32:34Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "59fea09a-d5ae-4c45-9a79-8f0a41bde3f5", "eventTime": "2018-10-29T04:32:34Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6a29deb6-7f24-4055-a1bb-e576c1fa45a2", "record_id": "flaws_cloudtrail:0000552:6a29deb6-7f24-4055-a1bb-e576c1fa45a2", "row_index": 552, "timestamp": "2018-10-29T04:32:35Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6a29deb6-7f24-4055-a1bb-e576c1fa45a2", "eventTime": "2018-10-29T04:32:35Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e37c2e47-da45-4944-9cc5-5467a82e6f71", "record_id": "flaws_cloudtrail:0000553:e37c2e47-da45-4944-9cc5-5467a82e6f71", "row_index": 553, "timestamp": "2018-10-29T04:32:36Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e37c2e47-da45-4944-9cc5-5467a82e6f71", "eventTime": "2018-10-29T04:32:36Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "1433ebda-c3cb-4a22-8d1e-d1f08bc253d4", "record_id": "flaws_cloudtrail:0000554:1433ebda-c3cb-4a22-8d1e-d1f08bc253d4", "row_index": 554, "timestamp": "2018-10-29T04:32:37Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "1433ebda-c3cb-4a22-8d1e-d1f08bc253d4", "eventTime": "2018-10-29T04:32:37Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "65bfcce2-5204-44f4-9a6f-e74c3352f791", "record_id": "flaws_cloudtrail:0000555:65bfcce2-5204-44f4-9a6f-e74c3352f791", "row_index": 555, "timestamp": "2018-10-29T04:32:37Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "65bfcce2-5204-44f4-9a6f-e74c3352f791", "eventTime": "2018-10-29T04:32:37Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "da4b7e8d-3b4e-4361-8236-3a0174cc747c", "record_id": "flaws_cloudtrail:0000556:da4b7e8d-3b4e-4361-8236-3a0174cc747c", "row_index": 556, "timestamp": "2018-10-29T04:32:38Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "da4b7e8d-3b4e-4361-8236-3a0174cc747c", "eventTime": "2018-10-29T04:32:38Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "77b408768-1cc3-4651-9e2e-c5f5a4e77c43", "record_id": "flaws_cloudtrail:0000557:77b408768-1cc3-4651-9e2e-c5f5a4e77c43", "row_index": 557, "timestamp": "2018-10-29T04:32:39Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "77b408768-1cc3-4651-9e2e-c5f5a4e77c43", "eventTime": "2018-10-29T04:32:39Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "73d69a57-1e41-4e81-8f4c-7ffd9271504f", "record_id": "flaws_cloudtrail:0000558:73d69a57-1e41-4e81-8f4c-7ffd9271504f", "row_index": 558, "timestamp": "2018-10-29T04:32:40Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "73d69a57-1e41-4e81-8f4c-7ffd9271504f", "eventTime": "2018-10-29T04:32:40Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3f9dd80c-ace3-434d-8a96-cb81ce7914ac", "record_id": "flaws_cloudtrail:0000559:3f9dd80c-ace3-434d-8a96-cb81ce7914ac", "row_index": 559, "timestamp": "2018-10-29T04:32:41Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3f9dd80c-ace3-434d-8a96-cb81ce7914ac", "eventTime": "2018-10-29T04:32:41Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "128124b45-71fb-4e3f-9d4f-7062172ee441", "record_id": "flaws_cloudtrail:0000560:128124b45-71fb-4e3f-9d4f-7062172ee441", "row_index": 560, "timestamp": "2018-10-29T04:32:42Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "128124b45-71fb-4e3f-9d4f-7062172ee441", "eventTime": "2018-10-29T04:32:42Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ea8a1e73-0354-4568-af4f-b98b1a0bfd83", "record_id": "flaws_cloudtrail:0000561:ea8a1e73-0354-4568-af4f-b98b1a0bfd83", "row_index": 561, "timestamp": "2018-10-29T04:32:43Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ea8a1e73-0354-4568-af4f-b98b1a0bfd83", "eventTime": "2018-10-29T04:32:43Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e761fbdd-2193-440a-b3c9-5cd410b33e73", "record_id": "flaws_cloudtrail:0000562:e761fbdd-2193-440a-b3c9-5cd410b33e73", "row_index": 562, "timestamp": "2018-10-29T04:32:44Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e761fbdd-2193-440a-b3c9-5cd410b33e73", "eventTime": "2018-10-29T04:32:44Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "8f7308c5-cedd-4f11-93f4-3b5e4f46fe7d", "record_id": "flaws_cloudtrail:0000563:8f7308c5-cedd-4f11-93f4-3b5e4f46fe7d", "row_index": 563, "timestamp": "2018-10-29T04:32:45Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "8f7308c5-cedd-4f11-93f4-3b5e4f46fe7d", "eventTime": "2018-10-29T04:32:45Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "328cbe8f-dc98-4a58-a5b7-85b004b97883", "record_id": "flaws_cloudtrail:0000564:328cbe8f-dc98-4a58-a5b7-85b004b97883", "row_index": 564, "timestamp": "2018-10-29T04:32:46Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "328cbe8f-dc98-4a58-a5b7-85b004b97883", "eventTime": "2018-10-29T04:32:46Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c2ce73f1-334f-4fb1-ad0d-2d3656e11b46", "record_id": "flaws_cloudtrail:0000565:c2ce73f1-334f-4fb1-ad0d-2d3656e11b46", "row_index": 565, "timestamp": "2018-10-29T04:32:47Z", "event_type": "GetPolicy", "event_source": "iam.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/Level6", "account_id": "811596193553", "principal_id": "AIDADO2GQD0K8TEF7KW1V", "user_name": "Level6", "access_key_id": "AKIA3Z2XBVUDFQ9TU4MD", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "158.3.252.59", "user_agent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 718, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c2ce73f1-334f-4fb1-ad0d-2d3656e11b46", "eventTime": "2018-10-29T04:32:47Z", "eventName": "GetPolicy", "eventSource": "iam.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "158.3.252.59", "userAgent": "aws-cli/1.16.10 Python/2.7.10 Darwin/17.7.0 botocore/1.12.0", "awsRegion": "us-east-1", "userIdentity": {"type": "IAMUser", "principalId": "AIDADO2GQD0K8TEF7KW1V", "arn": "arn:aws:iam::811596193553:user/Level6", "accountId": "811596193553", "accessKeyId": "AKIA3Z2XBVUDFQ9TU4MD", "userName": "Level6"}, "requestParameters": {"policyArn": "arn:aws:iam::811596193553:policy/list_apigateways"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3f9b71fb-4a24-449d-9778-ba20b8718fc9", "record_id": "flaws_cloudtrail:0000566:3f9b71fb-4a24-449d-9778-ba20b8718fc9", "row_index": 566, "timestamp": "2018-10-29T04:32:47Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3f9b71fb-4a24-449d-9778-ba20b8718fc9", "eventTime": "2018-10-29T04:32:47Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "82fa92b9-1ccb-4483-a395-99f6f2f41ecf", "record_id": "flaws_cloudtrail:0000567:82fa92b9-1ccb-4483-a395-99f6f2f41ecf", "row_index": 567, "timestamp": "2018-10-29T04:32:47Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "82fa92b9-1ccb-4483-a395-99f6f2f41ecf", "eventTime": "2018-10-29T04:32:47Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a9a91561-e1e7-4029-bc1e-2d647a8eb83c", "record_id": "flaws_cloudtrail:0000568:a9a91561-e1e7-4029-bc1e-2d647a8eb83c", "row_index": 568, "timestamp": "2018-10-29T04:32:48Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a9a91561-e1e7-4029-bc1e-2d647a8eb83c", "eventTime": "2018-10-29T04:32:48Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b8221bae-dd64-4249-9cb7-585a2445a7ff", "record_id": "flaws_cloudtrail:0000569:b8221bae-dd64-4249-9cb7-585a2445a7ff", "row_index": 569, "timestamp": "2018-10-29T04:32:49Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b8221bae-dd64-4249-9cb7-585a2445a7ff", "eventTime": "2018-10-29T04:32:49Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b7f74bc4-36da-4a47-a9b8-a78247ce361", "record_id": "flaws_cloudtrail:0000570:b7f74bc4-36da-4a47-a9b8-a78247ce361", "row_index": 570, "timestamp": "2018-10-29T04:32:49Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b7f74bc4-36da-4a47-a9b8-a78247ce361", "eventTime": "2018-10-29T04:32:49Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a58727ff-7d03-4257-bda1-78e7303b3e4e", "record_id": "flaws_cloudtrail:0000571:a58727ff-7d03-4257-bda1-78e7303b3e4e", "row_index": 571, "timestamp": "2018-10-29T04:32:51Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a58727ff-7d03-4257-bda1-78e7303b3e4e", "eventTime": "2018-10-29T04:32:51Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f4fcdf04-7011-489c-9872-0f8083d66693", "record_id": "flaws_cloudtrail:0000572:f4fcdf04-7011-489c-9872-0f8083d66693", "row_index": 572, "timestamp": "2018-10-29T04:32:52Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f4fcdf04-7011-489c-9872-0f8083d66693", "eventTime": "2018-10-29T04:32:52Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "c57ae6d8-099c-4f88-bc80-5d39fc3f7620", "record_id": "flaws_cloudtrail:0000573:c57ae6d8-099c-4f88-bc80-5d39fc3f7620", "row_index": 573, "timestamp": "2018-10-29T04:32:53Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "c57ae6d8-099c-4f88-bc80-5d39fc3f7620", "eventTime": "2018-10-29T04:32:53Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "58f908751-20d5-4f6c-9552-b086370afb408", "record_id": "flaws_cloudtrail:0000574:58f908751-20d5-4f6c-9552-b086370afb408", "row_index": 574, "timestamp": "2018-10-29T04:32:54Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 911, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "58f908751-20d5-4f6c-9552-b086370afb408", "eventTime": "2018-10-29T04:32:54Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "247cab33-4cd6-477d-946b-80f9e8c4ec2a", "record_id": "flaws_cloudtrail:0000575:247cab33-4cd6-477d-946b-80f9e8c4ec2a", "row_index": 575, "timestamp": "2018-10-29T04:32:55Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "247cab33-4cd6-477d-946b-80f9e8c4ec2a", "eventTime": "2018-10-29T04:32:55Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9b409966-14ab-4420-96f9-5b9103dc65bf", "record_id": "flaws_cloudtrail:0000576:9b409966-14ab-4420-96f9-5b9103dc65bf", "row_index": 576, "timestamp": "2018-10-29T04:32:56Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9b409966-14ab-4420-96f9-5b9103dc65bf", "eventTime": "2018-10-29T04:32:56Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "34b40540-8faf-4bec-a28b-d2307a604c5c", "record_id": "flaws_cloudtrail:0000577:34b40540-8faf-4bec-a28b-d2307a604c5c", "row_index": 577, "timestamp": "2018-10-29T04:32:57Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "34b40540-8faf-4bec-a28b-d2307a604c5c", "eventTime": "2018-10-29T04:32:57Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9ef8d516-e9e1-4d2f-a798-b41cc648882a", "record_id": "flaws_cloudtrail:0000578:9ef8d516-e9e1-4d2f-a798-b41cc648882a", "row_index": 578, "timestamp": "2018-10-29T04:32:58Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9ef8d516-e9e1-4d2f-a798-b41cc648882a", "eventTime": "2018-10-29T04:32:58Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9a7d6ceb-51d8-4eb0-aefb-bb420bcc35e5", "record_id": "flaws_cloudtrail:0000579:9a7d6ceb-51d8-4eb0-aefb-bb420bcc35e5", "row_index": 579, "timestamp": "2018-10-29T04:32:58Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9a7d6ceb-51d8-4eb0-aefb-bb420bcc35e5", "eventTime": "2018-10-29T04:32:58Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0217caaf-2be9-4f7a-a430-d3fc52899f", "record_id": "flaws_cloudtrail:0000580:0217caaf-2be9-4f7a-a430-d3fc52899f", "row_index": 580, "timestamp": "2018-10-29T04:32:59Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0217caaf-2be9-4f7a-a430-d3fc52899f", "eventTime": "2018-10-29T04:32:59Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "747811bd8-e77b-40de-8e83-b7685ab708a7", "record_id": "flaws_cloudtrail:0000581:747811bd8-e77b-40de-8e83-b7685ab708a7", "row_index": 581, "timestamp": "2018-10-29T04:33:00Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "747811bd8-e77b-40de-8e83-b7685ab708a7", "eventTime": "2018-10-29T04:33:00Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b37063-273a-4538-bf1a-93f3c9f27381", "record_id": "flaws_cloudtrail:0000582:b37063-273a-4538-bf1a-93f3c9f27381", "row_index": 582, "timestamp": "2018-10-29T04:33:01Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b37063-273a-4538-bf1a-93f3c9f27381", "eventTime": "2018-10-29T04:33:01Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "fc59d6bc-a0db-455d-a270-6b845d25ea50", "record_id": "flaws_cloudtrail:0000583:fc59d6bc-a0db-455d-a270-6b845d25ea50", "row_index": 583, "timestamp": "2018-10-29T04:33:02Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "fc59d6bc-a0db-455d-a270-6b845d25ea50", "eventTime": "2018-10-29T04:33:02Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cb3d259b-5f2e-41c5-a8a8-b7377ba5cb96", "record_id": "flaws_cloudtrail:0000584:cb3d259b-5f2e-41c5-a8a8-b7377ba5cb96", "row_index": 584, "timestamp": "2018-10-29T04:33:03Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cb3d259b-5f2e-41c5-a8a8-b7377ba5cb96", "eventTime": "2018-10-29T04:33:03Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f04d67ec-fd86-449e-8b6c-5756dfdd71e0", "record_id": "flaws_cloudtrail:0000585:f04d67ec-fd86-449e-8b6c-5756dfdd71e0", "row_index": 585, "timestamp": "2018-10-29T04:33:04Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f04d67ec-fd86-449e-8b6c-5756dfdd71e0", "eventTime": "2018-10-29T04:33:04Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ee8032d0-dd99-4ad5-b452-539df27a5972", "record_id": "flaws_cloudtrail:0000586:ee8032d0-dd99-4ad5-b452-539df27a5972", "row_index": 586, "timestamp": "2018-10-29T04:33:05Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ee8032d0-dd99-4ad5-b452-539df27a5972", "eventTime": "2018-10-29T04:33:05Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f452691-f0f9-4cfc-86ce-466c9ef1dcf0", "record_id": "flaws_cloudtrail:0000587:f452691-f0f9-4cfc-86ce-466c9ef1dcf0", "row_index": 587, "timestamp": "2018-10-29T04:33:06Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f452691-f0f9-4cfc-86ce-466c9ef1dcf0", "eventTime": "2018-10-29T04:33:06Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "2d8cb99e-3778-491e-a819-2811da29392d", "record_id": "flaws_cloudtrail:0000588:2d8cb99e-3778-491e-a819-2811da29392d", "row_index": 588, "timestamp": "2018-10-29T04:33:07Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "2d8cb99e-3778-491e-a819-2811da29392d", "eventTime": "2018-10-29T04:33:07Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f0bdf2de-a9da-4b3c-ad7b-4434ffab26f0", "record_id": "flaws_cloudtrail:0000589:f0bdf2de-a9da-4b3c-ad7b-4434ffab26f0", "row_index": 589, "timestamp": "2018-10-29T04:33:08Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f0bdf2de-a9da-4b3c-ad7b-4434ffab26f0", "eventTime": "2018-10-29T04:33:08Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "6c1f1273-bee9-4300-bbec-d2e7c0e890ab", "record_id": "flaws_cloudtrail:0000590:6c1f1273-bee9-4300-bbec-d2e7c0e890ab", "row_index": 590, "timestamp": "2018-10-29T04:33:08Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "6c1f1273-bee9-4300-bbec-d2e7c0e890ab", "eventTime": "2018-10-29T04:33:08Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "9f855594c-fe35-4314-a123-82965d3f03e", "record_id": "flaws_cloudtrail:0000591:9f855594c-fe35-4314-a123-82965d3f03e", "row_index": 591, "timestamp": "2018-10-29T04:33:09Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "9f855594c-fe35-4314-a123-82965d3f03e", "eventTime": "2018-10-29T04:33:09Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "cb8378f2-6758-4352-a056-613f433f8926", "record_id": "flaws_cloudtrail:0000592:cb8378f2-6758-4352-a056-613f433f8926", "row_index": 592, "timestamp": "2018-10-29T04:33:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "cb8378f2-6758-4352-a056-613f433f8926", "eventTime": "2018-10-29T04:33:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d459dd86-2532-4f52-b6b1-4e156100fa", "record_id": "flaws_cloudtrail:0000593:d459dd86-2532-4f52-b6b1-4e156100fa", "row_index": 593, "timestamp": "2018-10-29T04:33:10Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 907, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d459dd86-2532-4f52-b6b1-4e156100fa", "eventTime": "2018-10-29T04:33:10Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f4404f54-572f-4d4c-a650-5532ef80dd74", "record_id": "flaws_cloudtrail:0000594:f4404f54-572f-4d4c-a650-5532ef80dd74", "row_index": 594, "timestamp": "2018-10-29T04:33:11Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f4404f54-572f-4d4c-a650-5532ef80dd74", "eventTime": "2018-10-29T04:33:11Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "68b9b64b-0c92-444e-a124-d34ae9c2508e", "record_id": "flaws_cloudtrail:0000595:68b9b64b-0c92-444e-a124-d34ae9c2508e", "row_index": 595, "timestamp": "2018-10-29T04:33:12Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "68b9b64b-0c92-444e-a124-d34ae9c2508e", "eventTime": "2018-10-29T04:33:12Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e194a6ce-3104-4349-a412-8e309684e4424", "record_id": "flaws_cloudtrail:0000596:e194a6ce-3104-4349-a412-8e309684e4424", "row_index": 596, "timestamp": "2018-10-29T04:33:13Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e194a6ce-3104-4349-a412-8e309684e4424", "eventTime": "2018-10-29T04:33:13Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0fc576cb-0b10-4b3f-914e-4e862292c8c0", "record_id": "flaws_cloudtrail:0000597:0fc576cb-0b10-4b3f-914e-4e862292c8c0", "row_index": 597, "timestamp": "2018-10-29T04:33:14Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0fc576cb-0b10-4b3f-914e-4e862292c8c0", "eventTime": "2018-10-29T04:33:14Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "d790bb38-474b-45cf-aec6-a563bee320887", "record_id": "flaws_cloudtrail:0000598:d790bb38-474b-45cf-aec6-a563bee320887", "row_index": 598, "timestamp": "2018-10-29T04:33:15Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 910, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "d790bb38-474b-45cf-aec6-a563bee320887", "eventTime": "2018-10-29T04:33:15Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "a0741e7e-a174-49db-9c35-aa05decb94fe", "record_id": "flaws_cloudtrail:0000599:a0741e7e-a174-49db-9c35-aa05decb94fe", "row_index": 599, "timestamp": "2018-10-29T04:33:16Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "a0741e7e-a174-49db-9c35-aa05decb94fe", "eventTime": "2018-10-29T04:33:16Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "408f97e1-6465-44ce-8f60-9b19784", "record_id": "flaws_cloudtrail:0000600:408f97e1-6465-44ce-8f60-9b19784", "row_index": 600, "timestamp": "2018-10-29T04:33:17Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 904, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "408f97e1-6465-44ce-8f60-9b19784", "eventTime": "2018-10-29T04:33:17Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "674ba8aa-9a32-4d1d-8abf-e43989b3788a", "record_id": "flaws_cloudtrail:0000601:674ba8aa-9a32-4d1d-8abf-e43989b3788a", "row_index": 601, "timestamp": "2018-10-29T04:33:18Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "674ba8aa-9a32-4d1d-8abf-e43989b3788a", "eventTime": "2018-10-29T04:33:18Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "b3ea42ab-1c3b-48db-ac50-1cfff5eae875", "record_id": "flaws_cloudtrail:0000602:b3ea42ab-1c3b-48db-ac50-1cfff5eae875", "row_index": 602, "timestamp": "2018-10-29T04:33:18Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "b3ea42ab-1c3b-48db-ac50-1cfff5eae875", "eventTime": "2018-10-29T04:33:18Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "ce7ab086-4427-4616-8ac4-1a7593a8eac1", "record_id": "flaws_cloudtrail:0000603:ce7ab086-4427-4616-8ac4-1a7593a8eac1", "row_index": 603, "timestamp": "2018-10-29T04:33:19Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "ce7ab086-4427-4616-8ac4-1a7593a8eac1", "eventTime": "2018-10-29T04:33:19Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "4dcd5914-7924-414c-8fd2-4b839981c62", "record_id": "flaws_cloudtrail:0000604:4dcd5914-7924-414c-8fd2-4b839981c62", "row_index": 604, "timestamp": "2018-10-29T04:33:20Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "4dcd5914-7924-414c-8fd2-4b839981c62", "eventTime": "2018-10-29T04:33:20Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "3525adc7-85c3-4ba1-b816-db2e1a1dd5b6", "record_id": "flaws_cloudtrail:0000605:3525adc7-85c3-4ba1-b816-db2e1a1dd5b6", "row_index": 605, "timestamp": "2018-10-29T04:33:21Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "3525adc7-85c3-4ba1-b816-db2e1a1dd5b6", "eventTime": "2018-10-29T04:33:21Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "e6a982c5-a5ae-4ce4-8439-1f50d943bdf2", "record_id": "flaws_cloudtrail:0000606:e6a982c5-a5ae-4ce4-8439-1f50d943bdf2", "row_index": 606, "timestamp": "2018-10-29T04:33:22Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "e6a982c5-a5ae-4ce4-8439-1f50d943bdf2", "eventTime": "2018-10-29T04:33:22Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0ba388bb-c6b6-4d2e-9449-2badb2152e11", "record_id": "flaws_cloudtrail:0000607:0ba388bb-c6b6-4d2e-9449-2badb2152e11", "row_index": 607, "timestamp": "2018-10-29T04:33:23Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 908, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0ba388bb-c6b6-4d2e-9449-2badb2152e11", "eventTime": "2018-10-29T04:33:23Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "0d91e384-1b15-4ef8-a241-545127ec", "record_id": "flaws_cloudtrail:0000608:0d91e384-1b15-4ef8-a241-545127ec", "row_index": 608, "timestamp": "2018-10-29T04:33:24Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 905, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "0d91e384-1b15-4ef8-a241-545127ec", "eventTime": "2018-10-29T04:33:24Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}
{"benchmark_source": "flaws_cloudtrail", "source_record_id": "f764dc36-cfdc-49fa-bcbc-f3d1784122f3", "record_id": "flaws_cloudtrail:0000609:f764dc36-cfdc-49fa-bcbc-f3d1784122f3", "row_index": 609, "timestamp": "2018-10-29T04:33:25Z", "event_type": "AssumeRole", "event_source": "sts.amazonaws.com", "principal": {"type": "IAMUser", "arn": "arn:aws:iam::811596193553:user/backup", "account_id": "811596193553", "principal_id": "AIDA9BO36HFBHKGJAO9C1", "user_name": "backup", "access_key_id": "AKIA01U43UX3RBRDXF4Q", "session_issuer_arn": null, "session_issuer_user_name": null}, "network": {"source_ip": "253.0.255.253", "user_agent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "aws_region": "us-east-1"}, "resource_arns": [], "raw_record_size_bytes": 909, "raw_record_depth": 2, "raw_record_top_level_keys": ["awsRegion", "errorCode", "errorMessage", "eventID", "eventName", "eventSource", "eventTime", "eventType", "eventVersion", "recipientAccountId", "requestID", "requestParameters", "responseElements", "sourceIPAddress", "userAgent", "userIdentity"], "raw_record": {"eventID": "f764dc36-cfdc-49fa-bcbc-f3d1784122f3", "eventTime": "2018-10-29T04:33:25Z", "eventName": "AssumeRole", "eventSource": "sts.amazonaws.com", "eventType": "AwsApiCall", "sourceIPAddress": "253.0.255.253", "userAgent": "aws-sdk-java/1.11.301 Linux/4.9.93-linuxkit-aufs Java_HotSpot(TM)_64-Bit_Server_VM/25.172-b11 java/1.8.0_172", "awsRegion": "us-east-1", "errorCode": "AccessDenied", "errorMessage": "User: arn:aws:iam::811596193553:user/backup is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::563230777126:role/VGSCrossAccountSignIn", "userIdentity": {"type": "IAMUser", "principalId": "AIDA9BO36HFBHKGJAO9C1", "arn": "arn:aws:iam::811596193553:user/backup", "accountId": "811596193553", "accessKeyId": "AKIA01U43UX3RBRDXF4Q", "userName": "backup"}, "resources": []}}