In CloudTrail, the referenced resources section behaves in unexpected ways. For example, in the CreateUser event, there are 3 referenced resources, but they all actually point to the same user. This makes it difficult to parse programatically. On the other hand, what if there is another event type with 2 or more referenced resource of the same type, but they actually point to two different resources? How can one programatically parse the referenced resources in cloudtrail events in a correct and consistent way?
