AWS Sign-In

eventName	Description	Sample	Rule
any	Catch-all entry for AWS Sign-In rules that match the service but not a specific eventName.	N	N
ConsoleLogin	Records an authentication attempt to the AWS Management Console, including whether it succeeded or failed.	Y	Y
GetSigninToken	Retrieves a sign-in token used to grant console access to a federated user via the AWS federation endpoint.	Y	Y
PasswordRecoveryRequested	Records a request to initiate the root account password recovery process.	N	Y
CreateOAuth2Token	CreateOAuth2Token API Path: /v1/token Request Method: POST Content-Type: application/json or application/x-www-form-urlencoded This API implements OAuth 2.0 flows for AWS Sign-In CLI clients, supporting both: Authorization code redemption (.	N	N
DeleteConsoleAuthorizationConfiguration	Delete console authorization configuration with automatic scope detection	Y	N
DeleteResourcePermissionStatement	Remove a permission statement from the account's SignIn resource-based policy	N	N
GetConsoleAuthorizationConfiguration	Get console authorization configuration with automatic scope detection	Y	N
GetResourcePolicy	Retrieve the account's consolidated SignIn resource-based policy	Y	N
ListResourcePermissionStatements	Retrieve all permission statements in the account's SignIn resource-based policy	Y	N
PutConsoleAuthorizationConfiguration	Enable console authorization configuration with automatic scope detection	N	N
PutResourcePermissionStatement	Create a permission statement in the account's SignIn resource-based policy	N	N
UserAuthentication	UserAuthentication recorded by CloudTrail for AWS Sign-In. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.	N	N
CreateOAuth2TokenWithIAM	Grants permission to exchange client credentials for an OAuth 2.0 access token scoped to a resource that can be used to access AWS services from applications	N	N
IntrospectOAuth2TokenWithIAM	Grants permission to inspect the metadata and state of an OAuth 2.0 access token or refresh token Implements RFC 7662 OAuth 2.0 Token Introspection over a SigV4-authenticated endpoint.	N	N
RevokeOAuth2TokenWithIAM	Grants permission to revoke an OAuth 2.0 refresh token and its associated refresh tokens Revokes a refresh_token issued by AWS Sign-In, invalidating the entire token chain so that the refresh_token can no longer be used to mint new access_t.	N	N

any: AWS Sign-In (catch-all)

Service: signin

Description

Catch-all entry for AWS Sign-In rules that match the service but not a specific eventName.

ConsoleLogin

Service: signin

Description

Records an authentication attempt to the AWS Management Console, including whether it succeeded or failed.

CloudTrail management event, logged by default. Logged as eventType AwsConsoleSignIn (not AwsApiCall); requestParameters is null. Console sign-in events for the global endpoint are recorded in us-east-1. A failed sign-in does not set errorCode: it sets responseElements.ConsoleLogin = Failure and errorMessage = Failed authentication, so query those fields for failures.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`eventName`	27 detection rules	Kusto, Panther, Sigma, Splunk
`userIdentity.type`	10 detection rules	Elastic, Panther
`event.action`	7 detection rules	Elastic
`event.outcome`	7 detection rules	Elastic
`event.provider`	7 detection rules	Elastic
`eventSource`	7 detection rules	Panther, Sigma
`security_result.action`	6 detection rules	YARA-L
`action`	4 detection rules	Splunk
`errorMessage`	4 detection rules	Sigma, Splunk
`additionalEventData.MFAUsed`	3 detection rules	Sigma
`additionalEventData.MFAUsed`	3 detection rules	Splunk
`responseElements.ConsoleLogin`	3 detection rules	Panther
`responseElements.ConsoleLogin`	3 detection rules	Sigma
`security_result.description`	3 detection rules	YARA-L
`additionalEventData.SamlProviderArn`	2 detection rules	Panther
`SessionIssuerUserName`	2 detection rules	Kusto
`additionalEventData.MFAUsed`	1 detection rule	Panther
`aws.cloudtrail.console_login.additional_eventdata.mfa_used`	1 detection rule	Elastic
`errorCode`	1 detection rule	Splunk
`extensions.auth.auth_details`	1 detection rule	YARA-L
`security_result.summary`	1 detection rule	YARA-L
`source.geo.country_iso_code`	1 detection rule	Elastic
`sourceIPAddress`	1 detection rule	Kusto
`user.id`	1 detection rule	Elastic
`userIdentity.arn`	1 detection rule	Panther
`userIdentity.sessionContext.attributes.mfaAuthenticated`	1 detection rule	Panther

Example CloudTrail Event #

{
  "additionalEventData": {
    "LoginTo": "https://console.aws.amazon.com/console/home",
    "MFAUsed": "No",
    "MobileVersion": "No"
  },
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "70e5932e-9022-4b38-837e-ca10dad94eb7",
  "eventName": "ConsoleLogin",
  "eventSource": "signin.amazonaws.com",
  "eventTime": "2023-07-10T12:23:15Z",
  "eventType": "AwsConsoleSignIn",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123837392027",
  "requestParameters": null,
  "responseElements": {
    "ConsoleLogin": "Success"
  },
  "sourceIPAddress": "192.168.10.20",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "signin.aws.amazon.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "stratus-red-team_01190e38-873e-4cc4-aede-7ceb7ffc2a4a",
  "userIdentity": {
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/stratus-red-team-nmfalu-gfjyeaypjt",
    "principalId": "AIDATFQR7NSCYG26CT6RI",
    "type": "IAMUser",
    "userName": "stratus-red-team-nmfalu-gfjyeaypjt"
  }
}

Common Indicators #

Positive field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis. This is separate from Fields accounting, which also includes exclusions and counts distinct attached rules.

Field	Kind	Value	Rules	Vendors
`event.outcome` (elastic rule field)	eq	`success`	6 rules	elastic
`action` (splunk rule field)	eq	`failure`	4 rules	splunk
`aws::errorMessage`	eq	`failed authentication`	4 rules	sigma, splunk
`additionalEventData.MFAUsed`	eq	`no`	3 rules	sigma, splunk
`additionalEventData.MFAUsed`	eq	`yes`	3 rules	sigma, splunk
`security_result.action (Chronicle)`	eq	`BLOCK`	3 rules	chronicle
`MFAUsed` (kusto rule field)	ne	`yes`	2 rules	kusto
`aws::userIdentity.type` (panther rule field)	eq	`Root`	2 rules	panther
`aws::userIdentity.type` (elastic rule field)	eq	`iamuser`	2 rules	elastic
`aws::userIdentity.type` (elastic rule field)	eq	`root`	2 rules	elastic
`aws::userIdentity.type` (elastic rule field)	eq	`AssumedRole`	1 rule	elastic
`failed_attempts` (splunk rule field)	gt	`20`	2 rules	splunk
`responseElements.ConsoleLogin` (panther rule field)	eq	`Success`	2 rules	panther
`responseElements.ConsoleLogin` (sigma rule field)	eq	`failure`	2 rules	sigma
`security_result.description (Chronicle)`	eq	`Reason: Failed authentication`	2 rules	chronicle

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

AWS ConsoleLogin Failed Authentication source medium: Detects failed AWS console login attempts due to authentication failures. Monitoring these events is crucial for identifying potential brute-force attacks or unauthorized access attempts to AWS accounts.T1110
AWS Successful Console Login Without MFA source medium: Detects successful AWS console logins that were performed without Multi-Factor Authentication (MFA). This alert can be used to identify potential unauthorized access attempts, as logging in without MFA can indicate compromised credentials or misconfigured security settings.T1078, T1078.004
Console Login With MFA source informational: Detects a console login with MFAT1078

Show 3 more (6 total) on the rules page

Elastic #

AWS GetFederationToken Followed by Console Login via Federation Exchange source high: Detects the three-event chain produced by tools like aws_consoler that convert exfiltrated long-term IAM access keys into browser-accessible AWS console sessions: GetFederationToken obtains temporary credentials, GetSigninToken exchanges them for a federation sign-in token via the AWS federation endpoint, and ConsoleLogin confirms the resulting console session was opened — all from the same source IP within two minutes. This sequence is a high-confidence indicator of credential abuse using stolen IAM access keys.T1606↳ also matches GetSigninToken
AWS Management Console Brute Force of Root User Identity source high: Identifies a high number of failed authentication attempts to the AWS management console for the Root user identity. An adversary may attempt to brute force the password for the Root user identity, as it has complete access to all services and resources for the AWS account.T1110, T1110.001
AWS IAM User Console Login from Multiple Geolocations source medium: Identifies an IAM user that successfully signs in to the AWS Management Console from two or more distinct countries within a short window. A single user authenticating from multiple geographic locations in a brief period is physically implausible and indicates that the account's credentials or console session are being used from more than one place at once. This is a hallmark of adversary-in-the-middle (AiTM) phishing and session theft, where the legitimate user signs in from their location while the attacker replays the captured session or credentials from their own infrastructure. Because the attacker logs in from a different network, the divergent sign-in geolocations are the detectable signal even when MFA appears satisfied (AiTM relays the live MFA challenge). This is the CloudTrail-native analog of identity-provider impossible-travel sign-in detections.T1078, T1078.004, T1539

Show 4 more (7 total) on the rules page

Splunk #

AWS Console Login Failed During MFA Challenge source: The following analytic identifies failed authentication attempts to the AWS Console during the Multi-Factor Authentication (MFA) challenge. It leverages AWS CloudTrail logs, specifically the additionalEventData field, to detect when MFA…T1586, T1586.003, T1621
AWS Credential Access Failed Login source: The following analytic identifies unsuccessful login attempts to the AWS Management Console using a specific user identity. It leverages AWS CloudTrail logs to detect failed authentication events associated with the AWS ConsoleLogin…T1110, T1110.001, T1586, T1586.003
AWS High Number Of Failed Authentications For User source: The following analytic detects an AWS account experiencing more than 20 failed authentication attempts within a 5-minute window. It leverages AWS CloudTrail logs to identify multiple failed ConsoleLogin events. This behavior is significant…T1201

Show 7 more (10 total) on the rules page

Kusto #

Failed AzureAD logons but success logon to AWS Console source medium: Identifies a list of IP addresses with a minimum number (defualt of 5) of failed logon attempts to Microsoft Entra ID. Uses that list to identify any successful AWS Console logons from these IPs within the same timeframe.T1078, T1110
AWSCloudTrail - Login to AWS Management Console without MFA source low: Identifies successful AWS Management Console sign-ins where CloudTrail records a ConsoleLogin event without multi-factor authentication. The rule looks for logins where MFAUsed is not Yes and the console response is not Failure, which can indicate credential misuse or weak account protection.T1078
AWSCloudTrail - NRT Login to AWS Management Console without MFA source low: Multi-Factor Authentication (MFA) helps you to prevent credential compromise. This alert identifies logins to the AWS Management Console without MFA. You can limit this detection to trigger for administrative accounts if you do not have MFA enabled on all accounts. This is done by looking at the eventName ConsoleLogin and if the AdditionalEventData field indicates MFA was NOT used and the ResponseElements field indicates NOT a Failure. Thereby indicating that a non-MFA login was successful.T1078

YARA-L #

AWS Console Login Without MFA source low: Detect when a user logs into AWS console without MFA.T1078
AWS High Number Of Unknown User Authentication Attempts source low: Detects when a high number of failed authentication attempts happen for unknown users.T1110
AWS Successful Console Authentication From Multiple IPs source medium: Detects when an AWS user successfully authenticating from more than one unique IP address within 5 minutes.T1586

Show 3 more (6 total) on the rules page

Panther #

AWS Console Login source informational
Logins Without MFA source high: A console login was made without multi-factor authentication.T1078
Logins Without SAML source high: An AWS console login was made without SAML/SSO.T1078

Show 5 more (8 total) on the rules page

References #

Sample log: invictus-ir/aws_dataset

GetSigninToken

Service: signin

Description

Retrieves a sign-in token used to grant console access to a federated user via the AWS federation endpoint.

CloudTrail management event, logged by default. Logged as eventType AwsConsoleSignIn (not AwsApiCall). The event records the federation endpoint call that issues a sign-in token for constructing a console URL.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`eventName`	4 detection rules	Panther, Sigma
`event.action`	3 detection rules	Elastic
`event.outcome`	3 detection rules	Elastic
`event.provider`	3 detection rules	Elastic
`errorCode`	2 detection rules	Sigma
`eventSource`	2 detection rules	Panther, Sigma
`userAgent`	2 detection rules	Panther, Sigma
`user.id`	1 detection rule	Elastic
`userIdentity.type`	1 detection rule	Elastic

Example CloudTrail Event #

{
  "eventVersion": "1.08",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "AROA****************:User",
    "arn": "arn:aws:sts::123456789012:assumed-role/AWSReservedSSO_AdministratorAccess_6c63ce732f555555/TrailDiscover",
    "accountId": "123456789012",
    "accessKeyId": "AKIA****************",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROA****************:User",
        "arn": "arn:aws:iam::123456789012:role/aws-reserved/sso.amazonaws.com/us-east-2/AWSReservedSSO_AdministratorAccess_6c63ce732f555555",
        "accountId": "123456789012",
        "userName": "AWSReservedSSO_AdministratorAccess_6c63ce732f555555"
      },
      "webIdFederationData": {},
      "attributes": {
        "creationDate": "2024-09-24T08:12:45Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2024-09-24T08:12:45Z",
  "eventSource": "signin.amazonaws.com",
  "eventName": "GetSigninToken",
  "awsRegion": "us-east-2",
  "sourceIPAddress": "0.0.0.0",
  "userAgent": "Jersey/${project.version} (HttpUrlConnection 17.0.12)",
  "requestParameters": null,
  "responseElements": {
    "credentials": {
      "accessKeyId": "AKIA****************"
    },
    "GetSigninToken": "Success"
  },
  "additionalEventData": {
    "MobileVersion": "No",
    "MFAUsed": "No"
  },
  "eventID": "56678442-08db-4d88-af47-f994dd706a15",
  "readOnly": false,
  "eventType": "AwsConsoleSignIn",
  "managementEvent": true,
  "recipientAccountId": "123456789012",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.3",
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "us-east-2.signin.aws.amazon.com"
  }
}

Common Indicators #

Field	Kind	Value	Rules	Vendors
`aws::errorCode` (sigma rule field)	eq	`accessdenied`	1 rule	sigma
`aws::userIdentity.type` (elastic rule field)	eq	`AssumedRole`	1 rule	elastic
`user.id` (elastic rule field)	contains	`:i-`	1 rule	elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

AWS Console GetSigninToken Potential Abuse source medium: Detects potentially suspicious events involving "GetSigninToken". An adversary using the "aws_consoler" tool can leverage this console API to create temporary federated credential that help obfuscate which AWS credential is compromised (the original access key) and enables the adversary to pivot from the AWS CLI to console sessions without the need for MFA using the new access key issued in this request.T1021, T1021.007, T1550, T1550.001
Attempt To Get Signin Token source medium: Generate a SigninToken that can be used to login to the the AWS Management Console. Attackers might access via a Federated identity (such as AWS SSO) to the Management Console.T1078, T1078.004
Get Signin Token source high: Generate a SigninToken that can be used to login to the the AWS Management Console. Attackers might access via a Federated identity (such as AWS SSO) to the Management Console.T1078, T1078.004

Elastic #

AWS Sign-In Token Created source low: Captures requests to the AWS federation endpoint (signin.amazonaws.com) for GetSigninToken. This API exchanges existing temporary AWS credentials (e.g., from STS GetFederationToken or AssumeRole) for a short-lived sign-in token that is embedded in a one-click URL to the AWS Management Console. It is commonly used by custom federation tools and automation to pivot from programmatic access to a browser session. This is a building block rule meant to be used for correlation with other rules to detect suspicious activity.T1078, T1078.004, T1550, T1550.001
AWS GetFederationToken Followed by Console Login via Federation Exchange source high: Detects the three-event chain produced by tools like aws_consoler that convert exfiltrated long-term IAM access keys into browser-accessible AWS console sessions: GetFederationToken obtains temporary credentials, GetSigninToken exchanges them for a federation sign-in token via the AWS federation endpoint, and ConsoleLogin confirms the resulting console session was opened — all from the same source IP within two minutes. This sequence is a high-confidence indicator of credential abuse using stolen IAM access keys.T1606↳ also matches ConsoleLogin
AWS EC2 Instance Console Login via Assumed Role source high: Detects successful AWS Management Console or federation login activity performed using an EC2 instance’s assumed role credentials. EC2 instances typically use temporary credentials to make API calls, not to authenticate interactively via the console. A successful "ConsoleLogin" or "GetSigninToken" event using a session pattern that includes "i-" (the EC2 instance ID) is highly anomalous and may indicate that an adversary obtained the instance’s temporary credentials from the instance metadata service (IMDS) and used them to access the console. Such activity can enable lateral movement, privilege escalation, or persistence within the AWS account.T1021, T1021.007, T1078, T1078.004, T1550, T1550.001↳ also matches ConsoleLogin

Panther #

AWS Console GetSigninToken Potential Abuse source medium: Detects GetSigninToken calls from non-SSO user agents. An adversary can use tools like aws_consoler to convert compromised CLI credentials into a federated console session, bypassing MFA requirements and obscuring the original access key. The GetSigninToken API creates temporary console access from STS temporary credentials.T1021.007, T1550.001

References #

Sample log: TrailDiscover (CC-BY-4.0)

PasswordRecoveryRequested

Service: signin

Description

Records a request to initiate the root account password recovery process.

CloudTrail management event, logged by default. Only generated for root user password recovery, not for IAM users. Logged as eventType AwsConsoleSignIn.

Detection Fields #

Fields referenced by at least one attached detection rule. This view counts distinct rules and is not a complete event schema.

Name	Rules	Vendors
`event.action`	1 detection rule	Elastic
`event.outcome`	1 detection rule	Elastic
`event.provider`	1 detection rule	Elastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS Sign-In Root Password Recovery Requested source high: Identifies a password recovery request for the AWS account root user. In AWS, the PasswordRecoveryRequested event from signin.amazonaws.com applies to the root user’s “Forgot your password?” flow. Other identity types, like IAM and federated users, do not generate this event. This alert indicates that someone initiated the root password reset workflow for this account. Verify whether this was an expected action and review identity provider notifications/email to confirm legitimacy.T1078, T1078.004

CreateOAuth2Token

Service: signin

Description

CreateOAuth2Token API Path: /v1/token Request Method: POST Content-Type: application/json or application/x-www-form-urlencoded This API implements OAuth 2.0 flows for AWS Sign-In CLI clients, supporting both: Authorization code redemption (.

CloudTrail management event, logged by default. Part of the 'aws login' OAuth 2.0 PKCE flow. Paired with AuthorizeOAuth2Access, which records the browser-side authorization grant.

DeleteConsoleAuthorizationConfiguration

Service: signin

Description

Delete console authorization configuration with automatic scope detection

CloudTrail management event, logged by default. Write operations for this API are only supported in us-east-1. Calls from other regions return ValidationException.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ValidationException",
  "errorMessage": "Write operations only supported in us-east-1",
  "eventCategory": "Management",
  "eventID": "8d076cd2-e0eb-4fb3-9029-f3d4165383ff",
  "eventName": "DeleteConsoleAuthorizationConfiguration",
  "eventSource": "signin.amazonaws.com",
  "eventTime": "2026-06-29T19:45:33Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "a7dda559-108b-4da8-b586-e97e8aee7fd7",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "signin.us-west-1.api.aws",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteResourcePermissionStatement

Service: signin

Description

Remove a permission statement from the account's SignIn resource-based policy

CloudTrail management event, logged by default.

GetConsoleAuthorizationConfiguration

Service: signin

Description

Get console authorization configuration with automatic scope detection

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Console authorization configuration not found",
  "eventCategory": "Management",
  "eventID": "aa2a511d-9b5d-403c-b3b2-93ed63655736",
  "eventName": "GetConsoleAuthorizationConfiguration",
  "eventSource": "signin.amazonaws.com",
  "eventTime": "2026-06-29T18:32:45Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "b0227fea-f8b7-4467-adb1-6f5dfe6c980e",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "signin.us-west-1.api.aws",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

GetResourcePolicy

Service: signin

Description

Retrieve the account's consolidated SignIn resource-based policy

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Requested resource not found",
  "eventCategory": "Management",
  "eventID": "b8216e5d-bfd4-4baa-ba40-a5ef60ac3e35",
  "eventName": "GetResourcePolicy",
  "eventSource": "signin.amazonaws.com",
  "eventTime": "2026-06-29T18:32:45Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "a3d88373-11e7-43e0-9f5b-ab0ef5cb2b76",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "signin.us-west-1.api.aws",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListResourcePermissionStatements

Service: signin

Description

Retrieve all permission statements in the account's SignIn resource-based policy

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "errorCode": "ResourceNotFoundException",
  "errorMessage": "Requested resource not found",
  "eventCategory": "Management",
  "eventID": "d39a59c2-caaf-4def-a875-ee0240f8d510",
  "eventName": "ListResourcePermissionStatements",
  "eventSource": "signin.amazonaws.com",
  "eventTime": "2026-06-29T18:32:45Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.09",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "6c0c5687-538c-477a-b482-2619fa7852d8",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "signin.us-west-1.api.aws",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutConsoleAuthorizationConfiguration

Service: signin

Description

Enable console authorization configuration with automatic scope detection

CloudTrail management event, logged by default. Write operations for this API are only supported in us-east-1.

PutResourcePermissionStatement

Service: signin

Description

Create a permission statement in the account's SignIn resource-based policy

CloudTrail management event, logged by default.

UserAuthentication

Service: signin

Description

UserAuthentication recorded by CloudTrail for AWS Sign-In. Observed in real CloudTrail; no AWS SDK operation model documents it, so no description is available from the SDK.

Example CloudTrail Event #

This is a projected export row, not a complete CloudTrail record: it shows only the envelope columns a SIEM export retained. The export never carried userIdentity, requestParameters, responseElements, sourceIPAddress, recipientAccountId, eventCategory, so their absence here says nothing about the real event. Account identifiers, ARNs and endpoint hostnames in eventID, requestID, resources, tlsDetails, userAgent are replaced with the placeholders AWS uses in its own documentation, so those values are structurally real but not the originals. errorMessage is withheld: it is free-form prose that names customer resources, which no substitution rule can find reliably. eventTime is withheld because the export renders it in the exporting system's local timezone rather than the UTC a CloudTrail record carries.

{
  "eventVersion": "1.11",
  "eventID": "0a39e895-1493-4851-a194-4aa94b31f420",
  "eventSource": "signin.amazonaws.com",
  "eventName": "UserAuthentication",
  "awsRegion": "us-east-1",
  "eventType": "AwsServiceEvent",
  "readOnly": false,
  "managementEvent": true,
  "requestID": "538ead35-f2b2-49e9-93d9-786afc57ee74",
  "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36"
}

References #

Humpty from IRCC

CreateOAuth2TokenWithIAM

Service: signin

Description

Grants permission to exchange client credentials for an OAuth 2.0 access token scoped to a resource that can be used to access AWS services from applications

IntrospectOAuth2TokenWithIAM

Service: signin

Description

Grants permission to inspect the metadata and state of an OAuth 2.0 access token or refresh token Implements RFC 7662 OAuth 2.0 Token Introspection over a SigV4-authenticated endpoint.

RevokeOAuth2TokenWithIAM

Service: signin

Description

Grants permission to revoke an OAuth 2.0 refresh token and its associated refresh tokens Revokes a refresh_token issued by AWS Sign-In, invalidating the entire token chain so that the refresh_token can no longer be used to mint new access_t.

AWS Sign-In

any: AWS Sign-In (catch-all)

Description

ConsoleLogin

Description

Detection Fields #

Example CloudTrail Event #

Common Indicators #

Related events #

Detection Rules #

Sigma #

Elastic #

Splunk #

Kusto #

YARA-L #

Panther #

References #

GetSigninToken

Description

Detection Fields #

Example CloudTrail Event #

Common Indicators #

Related events #

Detection Rules #

Sigma #

Elastic #

Panther #

References #

PasswordRecoveryRequested

Description

Detection Fields #

Detection Rules #

Elastic #

CreateOAuth2Token

Description

DeleteConsoleAuthorizationConfiguration

Description

Example CloudTrail Event #

DeleteResourcePermissionStatement

Description

GetConsoleAuthorizationConfiguration

Description

Example CloudTrail Event #

GetResourcePolicy

Description

Example CloudTrail Event #

ListResourcePermissionStatements

Description

Example CloudTrail Event #

PutConsoleAuthorizationConfiguration

Description

PutResourcePermissionStatement

Description

UserAuthentication

Description

Example CloudTrail Event #

References #

CreateOAuth2TokenWithIAM

Description

IntrospectOAuth2TokenWithIAM

Description

RevokeOAuth2TokenWithIAM

Description