0

I am using CloudTrail to track the events in our AWS environment. Went under dashboard, clicked "View full Event history", then clicked on "Download Events", then "Download as CSV".

It generated a big file and I can see all the events that occurred in the system. The problem is when I look at the generated file in MS Excel, I see the username column and/or the Access Key column are empty for so many rows. The event names for those rows are: AssumeRole, CreateGrant, CreateLogStream, RetireGrant.

Was wondering if someone could please shed some light on this and let me know who/how these events got generated. Thank you in advance

Tina
  • 41
  • 3
  • Not every event will have all columns populated. In particular, `AssumeRole` is often invoked by an AWS service, and will not have an access key or username. Take a look at the raw events in the CloudTrail console to get a better understanding (select using event ID). – kdgregory Sep 27 '22 at 14:13

0 Answers0