By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Why is the userIdentity.sessionContext field missing from AwsConsoleAction entries in CloudTrail?

0

We are processing CloudTrail logs to check and highlight actions not protected by MFA.

When someone signs in as Root all the events with eventType AwsApiCall have sessionContext populated. For events of type AwsConsoleAction it is missing. Can we get the context and MFA state somehow?

(ConsoleAction events do have tlsDetails which is missing for AwsApiCall)

Topics
Management & Governance
Tags
AWS Management ConsoleAWS CloudTrail
Language
English
roj
asked 6 months ago67 views
No Answers

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content