AWS Management Console sign-in events
CloudTrail logs attempts to sign in to the AWS Management Console, the AWS Discussion Forums, and the AWS Support Center. All IAM user and root user sign-in events, as well as all federated user sign-in events, generate records in CloudTrail log files. For information about finding and viewing logs, see Finding your CloudTrail log files and Downloading your CloudTrail log files.
Note
If you use an AWS Sign-In global endpoint to sign-in, CloudTrail records the ConsoleLogin
event in
us-east-1.
If you use an AWS Sign-In Regional endpoint to sign-in, CloudTrail records the
ConsoleLogin
event in the appropriate Region for the endpoint. Regional sign-in endpoints have the following URL format:
https://
. For more
information about AWS Sign-In endpoints, see AWS Sign-In endpoints and
quotas.accountID
.signin.aws.amazon.com/console?region=region
Topics
Example event records for IAM users
The following examples show event records for several IAM user sign-in scenarios.
Topics
IAM user, successful sign-in without MFA
The following record shows that a user named Anaya
successfully signed in to the
AWS Management Console without using multi-factor authentication (MFA).
{ "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "EXAMPLE6E4XEGITWATV6R", "arn": "arn:aws:iam::999999999999:user/Anaya", "accountId": "999999999999", "userName": "Anaya" }, "eventTime": "2023-07-19T21:44:40Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0", "requestParameters": null, "responseElements": { "ConsoleLogin": "Success" }, "additionalEventData": { "LoginTo": "https://console.aws.amazon.com/console/home?hashArgs=%23&isauthcode=true&state=hashArgsFromTB_us-east-1_examplee9aba7f8", "MobileVersion": "No", "MFAUsed": "No" }, "eventID": "e1bf1000-86a4-4a78-81d7-EXAMPLE83102", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "999999999999", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "us-east-1.signin.aws.amazon.com" } }
IAM user, successful sign-in with MFA
The following record shows that an IAM user named Anaya
successfully signed in
to the AWS Management Console using multi-factor authentication (MFA).
{ "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "EXAMPLE6E4XEGITWATV6R", "arn": "arn:aws:iam::999999999999:user/Anaya", "accountId": "999999999999", "userName": "Anaya" }, "eventTime": "2023-07-19T22:01:30Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0", "requestParameters": null, "responseElements": { "ConsoleLogin": "Success" }, "additionalEventData": { "LoginTo": "https://console.aws.amazon.com/console/home?hashArgs=%23&isauthcode=true&state=hashArgsFromTB_us-east-1_examplebde32f3c9", "MobileVersion": "No", "MFAIdentifier": "arn:aws:iam::999999999999:mfa/mfa-device", "MFAUsed": "Yes" }, "eventID": "e1f76697-5beb-46e8-9cfc-EXAMPLEbde31", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "999999999999", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "us-east-1.signin.aws.amazon.com" } }
IAM user, unsuccessful sign-in
The following record shows an unsuccessful sign-in attempt from an IAM user named Paulo
.
{ "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "EXAMPLE6E4XEGITWATV6R", "accountId": "123456789012", "accessKeyId": "", "userName": "Paulo" }, "eventTime": "2023-07-19T22:01:20Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0", "errorMessage": "Failed authentication", "requestParameters": null, "responseElements": { "ConsoleLogin": "Failure" }, "additionalEventData": { "LoginTo": "https://console.aws.amazon.com/console/home?hashArgs=%23&isauthcode=true&state=hashArgsFromTB_us-east-1_examplebde32f3c9", "MobileVersion": "No", "MFAUsed": "Yes" }, "eventID": "66c97220-2b7d-43b6-a7a0-EXAMPLEbae9c", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "123456789012", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "us-east-1.signin.aws.amazon.com" } }
IAM user, sign-in process checks for MFA (single MFA device type)
The following shows that the sign-process checked whether multi-factor
authentication (MFA) is required for an IAM user during sign-in. In this example,
the mfaType
value is U2F MFA
, which indicates that the
IAM user enabled either a single MFA device or multiple MFA devices of the same
type (U2F MFA
).
{ "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "EXAMPLE6E4XEGITWATV6R", "accountId": "123456789012", "accessKeyId": "", "userName": "Alice" }, "eventTime": "2023-07-19T22:01:26Z", "eventSource": "signin.amazonaws.com", "eventName": "CheckMfa", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0", "requestParameters": null, "responseElements": { "CheckMfa": "Success" }, "additionalEventData": { "MfaType": "Virtual MFA" }, "eventID": "7d8a0746-b2e7-44f5-9917-EXAMPLEfb77c", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "123456789012", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "us-east-1.signin.aws.amazon.com" } }
IAM user, sign-in process checks for MFA (multiple MFA device types)
The following shows that the sign-process checked whether multi-factor
authentication (MFA) is required for an IAM user during sign-in. In this example,
the mfaType
value is Multiple MFA Devices
, which indicates
that the IAM user enabled multiple MFA device types.
{ "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "EXAMPLE6E4XEGITWATV6R", "accountId": "123456789012", "accessKeyId": "", "userName": "Mary" }, "eventTime": "2023-07-19T23:10:09Z", "eventSource": "signin.amazonaws.com", "eventName": "CheckMfa", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0", "requestParameters": null, "responseElements": { "CheckMfa": "Success" }, "additionalEventData": { "MfaType": "Multiple MFA Devices" }, "eventID": "19bd1a1c-76b1-4806-9d8f-EXAMPLE02a96", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "123456789012", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "signin.aws.amazon.com" } }
Example event records for root users
The following examples show event records for several root
user sign-in
scenarios.
Topics
Root user, successful sign-in without MFA
The following shows a successful sign-in event for a root user not using multi-factor authentication (MFA).
{ "eventVersion": "1.08", "userIdentity": { "type": "Root", "principalId": "111122223333", "arn": "arn:aws:iam::111122223333":root", "accountId": "111122223333"", "accessKeyId": "" }, "eventTime": "2023-07-12T13:35:31Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36", "requestParameters": null, "responseElements": { "ConsoleLogin": "Success" }, "additionalEventData": { "LoginTo": "https://console.aws.amazon.com/console/home?hashArgs=%23&isauthcode=true&nc2=h_ct&src=header-signin&state=hashArgsFromTB_ap-southeast-2_example80afacd389", "MobileVersion": "No", "MFAUsed": "No" }, "eventID": "4217cc13-7328-4820-a90c-EXAMPLE8002e6", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "111122223333", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "signin.aws.amazon.com" } }
Root user, successful sign-in with MFA
The following shows a successful sign-in event for a root user using multi-factor authentication (MFA).
{ "eventVersion": "1.08", "userIdentity": { "type": "Root", "principalId": "444455556666", "arn": "arn:aws:iam::444455556666:root", "accountId": "444455556666", "accessKeyId": "" }, "eventTime": "2023-07-13T03:04:43Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36", "requestParameters": null, "responseElements": { "ConsoleLogin": "Success" }, "additionalEventData": { "LoginTo": "https://ap-southeast-1.console.aws.amazon.com/ec2/home?region=ap-southeast-1&state=hashArgs%23Instances%3Av%3D3%3B%24case%3Dtags%3Atrue%255C%2Cclient%3Afalse%3B%24regex%3Dtags%3Afalse%255C%2Cclient%3Afalse&isauthcode=true", "MobileVersion": "No", "MFAIdentifier": "arn:aws:iam::444455556666:mfa/root-account-mfa-device", "MFAUsed": "Yes" }, "eventID": "e0176723-ea76-4275-83a3-EXAMPLEf03fb", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "444455556666", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "signin.aws.amazon.com" } }
Root user, unsuccessful sign-in
The following shows an unsuccessful sign-in event for a root user not using MFA.
{ "eventVersion": "1.08", "userIdentity": { "type": "Root", "principalId": "123456789012", "arn": "arn:aws:iam::123456789012:root", "accountId": "123456789012", "accessKeyId": "" }, "eventTime": "2023-07-16T04:33:40Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36", "errorMessage": "Failed authentication", "requestParameters": null, "responseElements": { "ConsoleLogin": "Failure" }, "additionalEventData": { "LoginTo": "https://us-east-1.console.aws.amazon.com/billing/home?region=us-east-1&state=hashArgs%23%2Faccount&isauthcode=true", "MobileVersion": "No", "MFAUsed": "No" }, "eventID": "f28d4329-5050-480b-8de0-EXAMPLE07329", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "123456789012", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "signin.aws.amazon.com" } }
Root user, MFA changed
The following shows an example event for a root user changing multi-factor authentication (MFA) settings.
{ "eventVersion": "1.08", "userIdentity": { "type": "Root", "principalId": "111122223333", "arn": "arn:aws:iam::111122223333:root", "accountId": "111122223333", "accessKeyId": "EXAMPLE4XX3IEV4PFQTH", "userName": "AWS ROOT USER", "sessionContext": { "sessionIssuer": {}, "webIdFederationData": {}, "attributes": { "creationDate": "2023-07-15T03:51:12Z", "mfaAuthenticated": "false" } } }, "eventTime": "2023-07-15T04:37:08Z", "eventSource": "iam.amazonaws.com", "eventName": "EnableMFADevice", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36", "requestParameters": { "userName": "AWS ROOT USER", "serialNumber": "arn:aws:iam::111122223333:mfa/root-account-mfa-device" }, "responseElements": null, "requestID": "9b45cd4c-a598-41e7-9170-EXAMPLE535f0", "eventID": "b4f18d55-d36f-49a0-afcb-EXAMPLEc026b", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111122223333", "eventCategory": "Management", "sessionCredentialFromConsole": "true" }
Root user, password changed
The following shows an example event for a root user changing their password.
{ "eventVersion": "1.08", "userIdentity": { "type": "Root", "principalId": "444455556666", "arn": "arn:aws:iam::444455556666:root", "accountId": "444455556666", "accessKeyId": "EXAMPLEAOTKEG44KPW5P", "sessionContext": { "sessionIssuer": {}, "webIdFederationData": {}, "attributes": { "creationDate": "2022-11-25T13:01:14Z", "mfaAuthenticated": "false" } } }, "eventTime": "2022-11-25T13:01:14Z", "eventSource": "iam.amazonaws.com", "eventName": "ChangePassword", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36", "requestParameters": null, "responseElements": null, "requestID": "c64254c2-e4ff-49c0-900e-EXAMPLE9e6d2", "eventID": "d059176c-4f4d-4a9e-b8d7-EXAMPLE2b7b3", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "444455556666", "eventCategory": "Management" }
Example event records for federated users
The following examples show event records for federated users. Federated users are given temporary security credentials to access AWS resources through an
AssumeRole
request.
The following shows an example event for a federation encryption request. The original access key ID is provided in the accessKeyId
field of the userIdentity
element.
The accessKeyId
field in the responseElements
contains a new access key ID if the requested sessionDuration
is passed in the encryption request, otherwise it contains the value
of the original access key ID.
{ "eventVersion": "1.08", "userIdentity": { "type": "AssumedRole", "principalId": "EXAMPLEUU4MH7OYK5ZCOA:JohnDoe", "arn": "arn:aws:sts::123456789012:assumed-role/roleName/JohnDoe", "accountId": "123456789012", "accessKeyId": "
originalAccessKeyID
", "sessionContext": { "sessionIssuer": { "type": "Role", "principalId": "EXAMPLEUU4MH7OYK5ZCOA", "arn": "arn:aws:iam::123456789012:role/roleName", "accountId": "123456789012", "userName": "roleName" }, "webIdFederationData": {}, "attributes": { "creationDate": "2023-09-25T21:30:39Z", "mfaAuthenticated": "false" } } }, "eventTime": "2023-09-25T21:30:39Z", "eventSource": "signin.amazonaws.com", "eventName": "GetSigninToken", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Java/1.8.0_382", "requestParameters": null, "responseElements": { "credentials": { "accessKeyId": "accessKeyID
" }, "GetSigninToken": "Success" }, "additionalEventData": { "MobileVersion": "No", "MFAUsed": "No" }, "eventID": "1d66615b-a417-40da-a38e-EXAMPLE8c89b", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "123456789012", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "us-east-1.signin.aws.amazon.com" } }
The following shows a successful sign-in event for a federated user; not using multi-factor authentication (MFA).
{ "eventVersion": "1.08", "userIdentity": { "type": "AssumedRole", "principalId": "EXAMPLEPHCNW7ZCASLJOH:JohnDoe", "arn": "arn:aws:sts::123456789012:assumed-role/
RoleName
/JohnDoe", "accountId": "123456789012", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "sessionContext": { "sessionIssuer": { "type": "Role", "principalId": "EXAMPLEPHCNW7ZCASLJOH", "arn": "arn:aws:iam::123456789012:role/RoleName
", "accountId": "123456789012", "userName": "RoleName
" }, "webIdFederationData": {}, "attributes": { "creationDate": "2023-09-22T16:15:47Z", "mfaAuthenticated": "false" } } }, "eventTime": "2023-09-22T16:15:47Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36", "requestParameters": null, "responseElements": { "ConsoleLogin": "Success" }, "additionalEventData": { "MobileVersion": "No", "MFAUsed": "No" }, "eventID": "b73f1ec6-c064-4cd3-ba83-EXAMPLE441d7", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "123456789012", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "us-east-1.signin.aws.amazon.com" } }