3 ms·
What's the forensics story (how do you understand after the fact who did what actions) for using IAM roles in this way? To my knowledge, Cloudtrail includes on
by philsnow 10y ago
What's the forensics story (how do you understand after the fact who did what actions) for using IAM roles in this way? To my knowledge, Cloudtrail includes only the assumed IAM role in the actual API actions.
- idunno246 10y agoThe assumerole api has a session name field which is arbitrary text that's included in cloud trail. Hologram sets this to the users name/email address from ldap
- copumpkin 10y agoYeah, all API actions will show up as being from ARN "arn:aws:sts::<account-id>:assumed-role/<hologram role>/<ldap username>"