aws-security-group-change-alerting/cloudtrail-event.json at master · denis-jdsouza/aws-security-group-change-alerting · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
{
    "version": "0",
    "id": "030cd8a2-511e-6e9b-ba8a",
    "detail-type": "AWS API Call via CloudTrail",
    "source": "aws.ec2",
    "account": "xyz",
    "time": "2021-02-18T08:43:41Z",
    "region": "ap-south-1",
    "resources": [],
    "detail": {
      "eventVersion": "1.08",
      "userIdentity": {
        "type": "Root",
        "principalId": "xyz",
        "arn": "arn:aws:iam::xyz:root",
        "accountId": "xyz",
        "sessionContext": {
          "sessionIssuer": {},
          "webIdFederationData": {},
          "attributes": {
            "mfaAuthenticated": "false",
            "creationDate": "2021-02-18T05:32:31Z"
          }
        }
      },
      "eventTime": "2021-02-18T08:43:41Z",
      "eventSource": "ec2.amazonaws.com",
      "eventName": "AuthorizeSecurityGroupIngress",
      "awsRegion": "ap-south-1",
      "sourceIPAddress": "0.0.0.0",
      "userAgent": "console.ec2.amazonaws.com",
      "requestParameters": {
        "groupId": "sg-xxxx",
        "ipPermissions": {
          "items": [
            {
              "ipProtocol": "tcp",
              "fromPort": 80,
              "toPort": 80,
              "groups": {},
              "ipRanges": {
                "items": [
                  {
                    "cidrIp": "0.0.0.0/0",
                    "description": "alert-testing"
                  }
                ]
              },
              "ipv6Ranges": {},
              "prefixListIds": {}
            }
          ]
        }
      },
      "responseElements": {
        "requestId": "e33580ca-9f13-452d-8781",
        "_return": "True"
      },
      "requestID": "e33580ca-9f13-452d-8781",
      "eventID": "b3ec7596-8bfc-4a40-a986",
      "readOnly": "False",
      "eventType": "AwsApiCall",
      "managementEvent": "True",
      "eventCategory": "Management"
    }
}