CloudTrail lists users I don't understand

0

My CloudTrail logs list many user names that have this format: i-07c83123218faa22fe

I've no idea what this means or what it references. Can anyone suggest where I look? Or where I might read up on things?

Much appreciated.

asked a year ago499 views
1 Answer
0
Accepted Answer

Hi, Cloud trail logs any/all AWS API calls - these could be from a 'real' end user - for example you yourself doing something in the console. It can also be from services though - for example an Amazon EC2 machine could be calling an API to do 'something'. When an EC2 machine does something cloudtrail logs the username as the instance name - so you can track it back. That same concept is true of lots of other services - you'll most likely see more entries from services than from real users.

There is some more information here that goes in to more detail: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html

If you look up the name you see in the logs in the EC2 screen you will find the machine it's coming from.

AWS
answered a year ago
profile pictureAWS
EXPERT
reviewed a year ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions