Skip to content

aws.cloudtrail: Add user.name to Cloudtrail's UserAuthentication events. - #15436

Merged
kcreddy merged 4 commits into
elastic:mainfrom
kcreddy:aws-cloudtrail-username
Sep 24, 2025
Merged

aws.cloudtrail: Add user.name to Cloudtrail's UserAuthentication events.#15436
kcreddy merged 4 commits into
elastic:mainfrom
kcreddy:aws-cloudtrail-username

Conversation

@kcreddy

@kcreddy kcreddy commented Sep 23, 2025

Copy link
Copy Markdown
Contributor

Proposed commit message

See title.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

  • [ ]

How to test this PR locally

Added new sample event. Should pass pipeline tests.

--- Test results for package: aws - START ---
╭─────────┬─────────────┬───────────┬────────────────────────────────────────────────────────────────────────────────┬────────┬──────────────╮
│ PACKAGE │ DATA STREAM │ TEST TYPE │ TEST NAME                                                                      │ RESULT │ TIME ELAPSED │
├─────────┼─────────────┼───────────┼────────────────────────────────────────────────────────────────────────────────┼────────┼──────────────┤
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-add-permission-json.log)                        │ PASS   │ 421.804625ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-add-user-to-group-json.log)                     │ PASS   │ 442.582916ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-assume-role-json.log)                           │ PASS   │ 482.757042ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-attach-group-policy-json.log)                   │ PASS   │ 431.603458ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-attach-role-policy-json.log)                    │ PASS   │    481.049ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-attach-user-policy-json.log)                    │ PASS   │ 433.713625ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-attach-user-role-json.log)                      │ PASS   │ 443.845917ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-authorize-security-group-egress-json.log)       │ PASS   │ 445.985334ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-authorize-security-group-ingress-json.log)      │ PASS   │ 391.239167ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-batch-get-secret-value-json.log)                │ PASS   │ 437.719584ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-change-password-json.log)                       │ PASS   │ 396.706709ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-cloudtrail-digest-json.log)                     │ PASS   │ 423.004958ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-console-login-json.log)                         │ PASS   │ 424.314708ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-converse-json.log)                              │ PASS   │ 428.644083ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-copy-object-json-minimal.log)                   │ PASS   │ 455.424167ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-copy-object-json.log)                           │ PASS   │ 460.962375ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-create-access-key-json.log)                     │ PASS   │ 378.943917ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-create-control-channel-json.log)                │ PASS   │ 430.813667ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-create-db-instance-json.log)                    │ PASS   │ 459.953625ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-create-detector-json.log)                       │ PASS   │ 387.812042ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-create-document-json.log)                       │ PASS   │ 435.065417ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-create-group-json.log)                          │ PASS   │ 424.566083ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-create-key-pair-json.log)                       │ PASS   │ 444.825833ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-create-lambda-json.log)                         │ PASS   │ 475.658583ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-create-policy-json.log)                         │ PASS   │ 412.825583ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-create-stack-json.log)                          │ PASS   │ 445.484167ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-create-stack-set-json.log)                      │ PASS   │ 458.791625ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-create-topic-json.log)                          │ PASS   │ 429.939709ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-create-traffic-mirror-filter-response-json.log) │ PASS   │ 437.375083ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-create-traffic-mirror-filter-rule-json.log)     │ PASS   │ 404.823583ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-create-traffic-mirror-session-request-json.log) │ PASS   │  428.18675ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-create-traffic-mirror-target-json.log)          │ PASS   │  468.09975ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-create-trail-json.log)                          │ PASS   │    440.746ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-create-trust-anchor-json.log)                   │ PASS   │ 431.047625ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-create-user-json.log)                           │ PASS   │ 402.964125ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-create-virtual-mfa-device-json.log)             │ PASS   │ 438.793458ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-deactivate-mfa-device-json.log)                 │ PASS   │ 455.417833ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-access-key-json.log)                     │ PASS   │ 448.147625ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-alarms-json.log)                         │ PASS   │ 443.233791ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-bucket-json.log)                         │ PASS   │ 442.755833ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-db-cluster-json.log)                     │ PASS   │ 422.946458ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-db-instance-json.log)                    │ PASS   │ 442.612209ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-detector-json.log)                       │ PASS   │  423.51025ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-file-system-json.log)                    │ PASS   │ 434.379542ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-flow-log-json.log)                       │ PASS   │ 441.207584ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-global-cluster-json.log)                 │ PASS   │ 426.384417ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-group-json.log)                          │ PASS   │    419.919ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-log-group-json.log)                      │ PASS   │  383.61525ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-log-stream-json.log)                     │ PASS   │ 451.619125ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-mount-target-json.log)                   │ PASS   │ 498.641291ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-network-acl-entry-json.log)              │ PASS   │ 432.155709ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-network-acl-json.log)                    │ PASS   │ 418.085125ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-resolver-query-log-config-json.log)      │ PASS   │ 394.987583ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-rule-group-json.log)                     │ PASS   │ 472.753125ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-rule-json.log)                           │ PASS   │ 513.648542ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-ssh-public-key-json.log)                 │ PASS   │ 412.859416ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-trail-json.log)                          │ PASS   │ 443.613292ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-user-json.log)                           │ PASS   │ 459.353417ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-virtual-mfa-device-json.log)             │ PASS   │ 498.794291ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-delete-web-acl-json.log)                        │ PASS   │ 451.421667ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-disable-key-json.log)                           │ PASS   │ 410.117833ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-enable-mfa-device-json.log)                     │ PASS   │   502.7915ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-get-bucket-policy-json.log)                     │ PASS   │  400.53725ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-get-caller-identity-json.log)                   │ PASS   │ 439.609584ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-get-parameter-json.log)                         │ PASS   │  441.81775ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-get-parameters-json.log)                        │ PASS   │ 398.425708ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-get-password-data-json.log)                     │ PASS   │  430.28175ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-get-policy-json.log)                            │ PASS   │ 444.239709ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-get-secret-value-json.log)                      │ PASS   │  430.24325ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-insight-json.log)                               │ PASS   │ 450.290209ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-list-attached-role-policies-json.log)           │ PASS   │ 430.407209ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-modify-db-cluster-json.log)                     │ PASS   │ 471.460125ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-modify-db-cluster-snapshot-attribute-json.log)  │ PASS   │ 447.494292ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-modify-db-instance-json.log)                    │ PASS   │ 459.152416ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-modify-db-snapshot-attributte-json.log)         │ PASS   │ 437.158333ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-modify-image-attribute-json.log)                │ PASS   │ 403.080625ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-modify-snapshot-attribute-json.log)             │ PASS   │ 445.762125ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-open-control-channel-json.log)                  │ PASS   │ 544.850583ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-publish-json.log)                               │ PASS   │ 437.331875ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-put-bucket-logging-json.log)                    │ PASS   │ 412.477459ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-put-bucket-replication-json.log)                │ PASS   │ 495.546917ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-put-bucket-versioning-json.log)                 │ PASS   │ 447.898583ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-put-object-json.log)                            │ PASS   │    528.447ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-remove-user-from-group-json.log)                │ PASS   │    413.339ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-restore-db-instnace-from-s3-json.log)           │ PASS   │ 475.880375ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-restore-db-instnace-from-snapshot-json.log)     │ PASS   │ 457.161375ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-run-instances-json.log)                         │ PASS   │ 484.415125ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-schedule-key-deletion-json.log)                 │ PASS   │ 429.687542ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-send-command-all-json.log)                      │ PASS   │ 411.528625ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-send-command-targets-json.log)                  │ PASS   │ 444.945333ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-send-serial-console-ssh-public-key-json.log)    │ PASS   │   441.7845ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-send-ssh-public-key-json.log)                   │ PASS   │ 391.568625ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-start-logging-json.log)                         │ PASS   │ 434.156209ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-start-session-json.log)                         │ PASS   │ 437.948791ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-stop-configuration-recorder.log)                │ PASS   │ 419.683625ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-stop-db-cluster-json.log)                       │ PASS   │ 455.499875ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-stop-db-instance-json.log)                      │ PASS   │ 420.448583ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-stop-logging-json.log)                          │ PASS   │ 447.931417ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-subscribe-json.log)                             │ PASS   │ 391.101375ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-terminate-instances-json.log)                   │ PASS   │ 464.996625ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-terminate-session-json.log)                     │ PASS   │ 435.405416ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-tls-details-json.log)                           │ PASS   │   440.8475ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-update-access-key-json.log)                     │ PASS   │ 488.739792ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-update-accout-password-policy-json.log)         │ PASS   │ 409.444417ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-update-assume-role-policy-json.log)             │ PASS   │ 412.091167ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-update-group-json.log)                          │ PASS   │ 414.997167ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-update-login-profile-json.log)                  │ PASS   │ 431.740334ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-update-ssh-public-key-json.log)                 │ PASS   │  465.29825ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-update-trail-json.log)                          │ PASS   │   423.9565ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-update-user-json.log)                           │ PASS   │ 402.820458ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-upload-ssh-public-key-json-flattened.log)       │ PASS   │ 444.152667ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-upload-ssh-public-key-json-keyword.log)         │ PASS   │ 457.419208ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-upload-ssh-public-key-json.log)                 │ PASS   │    443.659ms │
│ aws     │ cloudtrail  │ pipeline  │ (ingest pipeline warnings test-user-authentication.log)                        │ PASS   │ 454.318958ms │
│ aws     │ cloudtrail  │ pipeline  │ test-add-permission-json.log                                                   │ PASS   │  64.953167ms │
│ aws     │ cloudtrail  │ pipeline  │ test-add-user-to-group-json.log                                                │ PASS   │  57.183791ms │
│ aws     │ cloudtrail  │ pipeline  │ test-assume-role-json.log                                                      │ PASS   │  83.111625ms │
│ aws     │ cloudtrail  │ pipeline  │ test-attach-group-policy-json.log                                              │ PASS   │  63.856583ms │
│ aws     │ cloudtrail  │ pipeline  │ test-attach-role-policy-json.log                                               │ PASS   │  63.609541ms │
│ aws     │ cloudtrail  │ pipeline  │ test-attach-user-policy-json.log                                               │ PASS   │      66.01ms │
│ aws     │ cloudtrail  │ pipeline  │ test-attach-user-role-json.log                                                 │ PASS   │  65.960709ms │
│ aws     │ cloudtrail  │ pipeline  │ test-authorize-security-group-egress-json.log                                  │ PASS   │  65.945584ms │
│ aws     │ cloudtrail  │ pipeline  │ test-authorize-security-group-ingress-json.log                                 │ PASS   │   64.10825ms │
│ aws     │ cloudtrail  │ pipeline  │ test-batch-get-secret-value-json.log                                           │ PASS   │  64.205792ms │
│ aws     │ cloudtrail  │ pipeline  │ test-change-password-json.log                                                  │ PASS   │  64.484916ms │
│ aws     │ cloudtrail  │ pipeline  │ test-cloudtrail-digest-json.log                                                │ PASS   │  50.657417ms │
│ aws     │ cloudtrail  │ pipeline  │ test-console-login-json.log                                                    │ PASS   │  99.811917ms │
│ aws     │ cloudtrail  │ pipeline  │ test-converse-json.log                                                         │ PASS   │  64.983834ms │
│ aws     │ cloudtrail  │ pipeline  │ test-copy-object-json-minimal.log                                              │ PASS   │  61.528458ms │
│ aws     │ cloudtrail  │ pipeline  │ test-copy-object-json.log                                                      │ PASS   │  62.116208ms │
│ aws     │ cloudtrail  │ pipeline  │ test-create-access-key-json.log                                                │ PASS   │  54.455125ms │
│ aws     │ cloudtrail  │ pipeline  │ test-create-control-channel-json.log                                           │ PASS   │  60.598708ms │
│ aws     │ cloudtrail  │ pipeline  │ test-create-db-instance-json.log                                               │ PASS   │  63.347084ms │
│ aws     │ cloudtrail  │ pipeline  │ test-create-detector-json.log                                                  │ PASS   │  60.784708ms │
│ aws     │ cloudtrail  │ pipeline  │ test-create-document-json.log                                                  │ PASS   │  65.349166ms │
│ aws     │ cloudtrail  │ pipeline  │ test-create-group-json.log                                                     │ PASS   │  80.344791ms │
│ aws     │ cloudtrail  │ pipeline  │ test-create-key-pair-json.log                                                  │ PASS   │  61.693417ms │
│ aws     │ cloudtrail  │ pipeline  │ test-create-lambda-json.log                                                    │ PASS   │  63.738167ms │
│ aws     │ cloudtrail  │ pipeline  │ test-create-policy-json.log                                                    │ PASS   │  68.734834ms │
│ aws     │ cloudtrail  │ pipeline  │ test-create-stack-json.log                                                     │ PASS   │      65.44ms │
│ aws     │ cloudtrail  │ pipeline  │ test-create-stack-set-json.log                                                 │ PASS   │  68.060083ms │
│ aws     │ cloudtrail  │ pipeline  │ test-create-topic-json.log                                                     │ PASS   │  60.265875ms │
│ aws     │ cloudtrail  │ pipeline  │ test-create-traffic-mirror-filter-response-json.log                            │ PASS   │     63.188ms │
│ aws     │ cloudtrail  │ pipeline  │ test-create-traffic-mirror-filter-rule-json.log                                │ PASS   │   65.23525ms │
│ aws     │ cloudtrail  │ pipeline  │ test-create-traffic-mirror-session-request-json.log                            │ PASS   │  63.917791ms │
│ aws     │ cloudtrail  │ pipeline  │ test-create-traffic-mirror-target-json.log                                     │ PASS   │  61.152833ms │
│ aws     │ cloudtrail  │ pipeline  │ test-create-trail-json.log                                                     │ PASS   │  53.750833ms │
│ aws     │ cloudtrail  │ pipeline  │ test-create-trust-anchor-json.log                                              │ PASS   │   60.15425ms │
│ aws     │ cloudtrail  │ pipeline  │ test-create-user-json.log                                                      │ PASS   │  56.590334ms │
│ aws     │ cloudtrail  │ pipeline  │ test-create-virtual-mfa-device-json.log                                        │ PASS   │  52.443459ms │
│ aws     │ cloudtrail  │ pipeline  │ test-deactivate-mfa-device-json.log                                            │ PASS   │  55.602667ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-access-key-json.log                                                │ PASS   │  51.844042ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-alarms-json.log                                                    │ PASS   │  61.094834ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-bucket-json.log                                                    │ PASS   │  60.485916ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-db-cluster-json.log                                                │ PASS   │  61.803792ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-db-instance-json.log                                               │ PASS   │  63.213625ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-detector-json.log                                                  │ PASS   │  58.361083ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-file-system-json.log                                               │ PASS   │  63.069958ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-flow-log-json.log                                                  │ PASS   │  64.249667ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-global-cluster-json.log                                            │ PASS   │  62.713125ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-group-json.log                                                     │ PASS   │    62.6945ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-log-group-json.log                                                 │ PASS   │  59.944666ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-log-stream-json.log                                                │ PASS   │  61.364792ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-mount-target-json.log                                              │ PASS   │  62.267625ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-network-acl-entry-json.log                                         │ PASS   │  62.520833ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-network-acl-json.log                                               │ PASS   │  61.437166ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-resolver-query-log-config-json.log                                 │ PASS   │  61.500125ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-rule-group-json.log                                                │ PASS   │   62.83275ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-rule-json.log                                                      │ PASS   │  67.605458ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-ssh-public-key-json.log                                            │ PASS   │  53.090875ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-trail-json.log                                                     │ PASS   │  53.256083ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-user-json.log                                                      │ PASS   │    58.3755ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-virtual-mfa-device-json.log                                        │ PASS   │  55.456167ms │
│ aws     │ cloudtrail  │ pipeline  │ test-delete-web-acl-json.log                                                   │ PASS   │  62.487375ms │
│ aws     │ cloudtrail  │ pipeline  │ test-disable-key-json.log                                                      │ PASS   │  62.296583ms │
│ aws     │ cloudtrail  │ pipeline  │ test-enable-mfa-device-json.log                                                │ PASS   │  56.242291ms │
│ aws     │ cloudtrail  │ pipeline  │ test-get-bucket-policy-json.log                                                │ PASS   │  52.741333ms │
│ aws     │ cloudtrail  │ pipeline  │ test-get-caller-identity-json.log                                              │ PASS   │     59.834ms │
│ aws     │ cloudtrail  │ pipeline  │ test-get-parameter-json.log                                                    │ PASS   │  64.380166ms │
│ aws     │ cloudtrail  │ pipeline  │ test-get-parameters-json.log                                                   │ PASS   │  61.817041ms │
│ aws     │ cloudtrail  │ pipeline  │ test-get-password-data-json.log                                                │ PASS   │   61.80925ms │
│ aws     │ cloudtrail  │ pipeline  │ test-get-policy-json.log                                                       │ PASS   │  64.580292ms │
│ aws     │ cloudtrail  │ pipeline  │ test-get-secret-value-json.log                                                 │ PASS   │  60.093959ms │
│ aws     │ cloudtrail  │ pipeline  │ test-insight-json.log                                                          │ PASS   │  47.471875ms │
│ aws     │ cloudtrail  │ pipeline  │ test-list-attached-role-policies-json.log                                      │ PASS   │  60.157417ms │
│ aws     │ cloudtrail  │ pipeline  │ test-modify-db-cluster-json.log                                                │ PASS   │  60.830292ms │
│ aws     │ cloudtrail  │ pipeline  │ test-modify-db-cluster-snapshot-attribute-json.log                             │ PASS   │    62.8735ms │
│ aws     │ cloudtrail  │ pipeline  │ test-modify-db-instance-json.log                                               │ PASS   │  61.957292ms │
│ aws     │ cloudtrail  │ pipeline  │ test-modify-db-snapshot-attributte-json.log                                    │ PASS   │  92.100167ms │
│ aws     │ cloudtrail  │ pipeline  │ test-modify-image-attribute-json.log                                           │ PASS   │  92.192959ms │
│ aws     │ cloudtrail  │ pipeline  │ test-modify-snapshot-attribute-json.log                                        │ PASS   │  59.729042ms │
│ aws     │ cloudtrail  │ pipeline  │ test-open-control-channel-json.log                                             │ PASS   │  61.386083ms │
│ aws     │ cloudtrail  │ pipeline  │ test-publish-json.log                                                          │ PASS   │  63.037709ms │
│ aws     │ cloudtrail  │ pipeline  │ test-put-bucket-logging-json.log                                               │ PASS   │   60.69775ms │
│ aws     │ cloudtrail  │ pipeline  │ test-put-bucket-replication-json.log                                           │ PASS   │  63.537667ms │
│ aws     │ cloudtrail  │ pipeline  │ test-put-bucket-versioning-json.log                                            │ PASS   │   60.93875ms │
│ aws     │ cloudtrail  │ pipeline  │ test-put-object-json.log                                                       │ PASS   │  60.395709ms │
│ aws     │ cloudtrail  │ pipeline  │ test-remove-user-from-group-json.log                                           │ PASS   │  50.248667ms │
│ aws     │ cloudtrail  │ pipeline  │ test-restore-db-instnace-from-s3-json.log                                      │ PASS   │   61.65025ms │
│ aws     │ cloudtrail  │ pipeline  │ test-restore-db-instnace-from-snapshot-json.log                                │ PASS   │  61.957917ms │
│ aws     │ cloudtrail  │ pipeline  │ test-run-instances-json.log                                                    │ PASS   │  63.981167ms │
│ aws     │ cloudtrail  │ pipeline  │ test-schedule-key-deletion-json.log                                            │ PASS   │  60.638459ms │
│ aws     │ cloudtrail  │ pipeline  │ test-send-command-all-json.log                                                 │ PASS   │  53.164708ms │
│ aws     │ cloudtrail  │ pipeline  │ test-send-command-targets-json.log                                             │ PASS   │  62.872208ms │
│ aws     │ cloudtrail  │ pipeline  │ test-send-serial-console-ssh-public-key-json.log                               │ PASS   │  60.643125ms │
│ aws     │ cloudtrail  │ pipeline  │ test-send-ssh-public-key-json.log                                              │ PASS   │     58.893ms │
│ aws     │ cloudtrail  │ pipeline  │ test-start-logging-json.log                                                    │ PASS   │  52.563292ms │
│ aws     │ cloudtrail  │ pipeline  │ test-start-session-json.log                                                    │ PASS   │  59.238708ms │
│ aws     │ cloudtrail  │ pipeline  │ test-stop-configuration-recorder.log                                           │ PASS   │     77.416ms │
│ aws     │ cloudtrail  │ pipeline  │ test-stop-db-cluster-json.log                                                  │ PASS   │  62.212667ms │
│ aws     │ cloudtrail  │ pipeline  │ test-stop-db-instance-json.log                                                 │ PASS   │   60.38175ms │
│ aws     │ cloudtrail  │ pipeline  │ test-stop-logging-json.log                                                     │ PASS   │  51.485542ms │
│ aws     │ cloudtrail  │ pipeline  │ test-subscribe-json.log                                                        │ PASS   │  62.738041ms │
│ aws     │ cloudtrail  │ pipeline  │ test-terminate-instances-json.log                                              │ PASS   │  56.679541ms │
│ aws     │ cloudtrail  │ pipeline  │ test-terminate-session-json.log                                                │ PASS   │  61.301459ms │
│ aws     │ cloudtrail  │ pipeline  │ test-tls-details-json.log                                                      │ PASS   │  79.126625ms │
│ aws     │ cloudtrail  │ pipeline  │ test-update-access-key-json.log                                                │ PASS   │     52.312ms │
│ aws     │ cloudtrail  │ pipeline  │ test-update-accout-password-policy-json.log                                    │ PASS   │  52.037833ms │
│ aws     │ cloudtrail  │ pipeline  │ test-update-assume-role-policy-json.log                                        │ PASS   │     61.705ms │
│ aws     │ cloudtrail  │ pipeline  │ test-update-group-json.log                                                     │ PASS   │  73.221584ms │
│ aws     │ cloudtrail  │ pipeline  │ test-update-login-profile-json.log                                             │ PASS   │   53.85825ms │
│ aws     │ cloudtrail  │ pipeline  │ test-update-ssh-public-key-json.log                                            │ PASS   │  62.234083ms │
│ aws     │ cloudtrail  │ pipeline  │ test-update-trail-json.log                                                     │ PASS   │   65.12325ms │
│ aws     │ cloudtrail  │ pipeline  │ test-update-user-json.log                                                      │ PASS   │  54.015417ms │
│ aws     │ cloudtrail  │ pipeline  │ test-upload-ssh-public-key-json-flattened.log                                  │ PASS   │  53.584167ms │
│ aws     │ cloudtrail  │ pipeline  │ test-upload-ssh-public-key-json-keyword.log                                    │ PASS   │  54.087291ms │
│ aws     │ cloudtrail  │ pipeline  │ test-upload-ssh-public-key-json.log                                            │ PASS   │  53.296459ms │
│ aws     │ cloudtrail  │ pipeline  │ test-user-authentication.log                                                   │ PASS   │  54.249583ms │
╰─────────┴─────────────┴───────────┴────────────────────────────────────────────────────────────────────────────────┴────────┴──────────────╯
--- Test results for package: aws - END   ---
Done
@kcreddy kcreddy self-assigned this Sep 23, 2025
@kcreddy kcreddy added enhancement New feature or request Integration:aws AWS Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations] labels Sep 23, 2025
@kcreddy
kcreddy marked this pull request as ready for review September 23, 2025 09:14
@kcreddy
kcreddy requested a review from a team as a code owner September 23, 2025 09:14
@elasticmachine

elasticmachine commented Sep 23, 2025

Copy link
Copy Markdown

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)
@kcreddy
kcreddy requested review from a team as code owners September 23, 2025 09:14
efd6
efd6 reviewed Sep 24, 2025
View reviewed changes

@efd6 efd6 left a comment •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM after conflict and whitespace nit resolved.
Comment thread packages/aws/data_stream/cloudtrail/_dev/test/pipeline/test-user-authentication.log Outdated
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Sep 24, 2025

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport
@elasticmachine

elasticmachine commented Sep 24, 2025

Copy link
Copy Markdown

💚 Build Succeeded

History

cc @kcreddy
@elastic-sonarqube

elastic-sonarqube Bot commented Sep 24, 2025

Copy link
Copy Markdown

Quality Gate passed Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube
@kcreddy
kcreddy merged commit db74cb2 into elastic:main Sep 24, 2025
9 checks passed
@elastic-vault-github-plugin-prod

elastic-vault-github-plugin-prod Bot commented Sep 24, 2025

Copy link
Copy Markdown
Contributor

Package aws - 4.2.0 containing this change is available at https://epr.elastic.co/package/aws/4.2.0/
tehbooom pushed a commit to tehbooom/integrations that referenced this pull request Nov 19, 2025
@kcreddy
aws.cloudtrail: Add user.name to Cloudtrail's UserAuthentication …
c646cf7 
…events. (elastic#15436)

aws.cloudtrail: Add user.name to Cloudtrail's UserAuthentication events
@github-actions github-actions Bot mentioned this pull request Mar 24, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request Integration:aws AWS Team:Security-Service Integrations Security Service Integrations team [elastic/security-service-integrations]

3 participants

@kcreddy @elasticmachine @efd6