Quickstart

Query API and console operations on your account - for example by filtering on ConsoleLogin - I am curious as to why the username is hidden in this one.

I know why - there was an attempt to login to my account a month earlier using two usernames I don't have IAM users for - luckily I have MFA on as well.

{
    "eventVersion": "1.05",
    "userIdentity": {
        "type": "IAMUser",
        "accountId": "",
        "accessKeyId": "",
        "userName": "HIDDEN_DUE_TO_SECURITY_REASONS"
    },
    "eventTime": "2019-06-18T14:20:43Z",
    "eventSource": "signin.amazonaws.com",
    "eventName": "ConsoleLogin",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "24.114.98.47",
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36",
    "errorMessage": "No username found in supplied account",
    "requestParameters": null,
    "responseElements": {
        "ConsoleLogin": "Failure"
    },
    "additionalEventData": {
        "LoginTo": "https://console.aws.amazon.com/iam/home?region=us-east-1&state=hashArgs%23%2Fusers%2Fa-user-account%3Fsection%3Dsecurity_credentials&isauthcode=true",
        "MobileVersion": "No",
        "MFAUsed": "No"
    },
    "eventID": "6e028b54-b225-471c-8f5b-a2e249d68756",
    "eventType": "AwsConsoleSignIn",
    "recipientAccountId": ""
}

Page tree

AWS CloudTrail

Quickstart