Amazon Web Services Management Console sign-in events - Amazon CloudTrail
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon Web Services Management Console sign-in events

CloudTrail logs attempts to sign in to the Amazon Web Services Management Console, the Amazon Discussion Forums, and the Amazon Support Center. All IAM user and root user sign-in events, as well as all federated user sign-in events, generate records in CloudTrail log files. For information about finding and viewing logs, see Finding your CloudTrail log files and Downloading your CloudTrail log files.

Note

The Region recorded in a ConsoleLogin event varies based on the user type and whether you use a global or regional endpoint to sign in.

  • If you sign-in as the root user, CloudTrail records the event in us-east-1.

  • If you sign-in with an IAM user and use the global endpoint, CloudTrail records the Region of the ConsoleLogin event as follows:

    • If an account alias cookie is present in the browser, CloudTrail records the ConsoleLogin event in one of the following regions: us-east-2, eu-north-1, or ap-southeast-2. This is because the console proxy redirects the user based on the latency from the user sign-in location.

    • If an account alias cookie is not present in the browser, CloudTrail records the ConsoleLogin event in us-east-1. This is because the console proxy redirects back to the global sign-in.

  • If you sign-in with an IAM user and use a Regional endpoint, CloudTrail records the ConsoleLogin event in the appropriate Region for the endpoint. For more information about Amazon Sign-In endpoints, see Amazon Sign-In endpoints and quotas.

Example event records for IAM users

The following examples show event records for several IAM user sign-in scenarios.

IAM user, successful sign-in without MFA

The following record shows that a user named Anaya successfully signed in to the Amazon Web Services Management Console without using multi-factor authentication (MFA).

{ "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "EXAMPLE6E4XEGITWATV6R", "arn": "arn:aws:iam::999999999999:user/Anaya", "accountId": "999999999999", "userName": "Anaya" }, "eventTime": "2023-07-19T21:44:40Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0", "requestParameters": null, "responseElements": { "ConsoleLogin": "Success" }, "additionalEventData": { "LoginTo": "https://console.aws.amazon.com/console/home?hashArgs=%23&isauthcode=true&state=hashArgsFromTB_us-east-1_examplee9aba7f8", "MobileVersion": "No", "MFAUsed": "No" }, "eventID": "e1bf1000-86a4-4a78-81d7-EXAMPLE83102", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "999999999999", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "us-east-1.signin.aws.amazon.com" } }

IAM user, successful sign-in with MFA

The following record shows that an IAM user named Anaya successfully signed in to the Amazon Web Services Management Console using multi-factor authentication (MFA).

{ "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "EXAMPLE6E4XEGITWATV6R", "arn": "arn:aws:iam::999999999999:user/Anaya", "accountId": "999999999999", "userName": "Anaya" }, "eventTime": "2023-07-19T22:01:30Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0", "requestParameters": null, "responseElements": { "ConsoleLogin": "Success" }, "additionalEventData": { "LoginTo": "https://console.aws.amazon.com/console/home?hashArgs=%23&isauthcode=true&state=hashArgsFromTB_us-east-1_examplebde32f3c9", "MobileVersion": "No", "MFAIdentifier": "arn:aws:iam::999999999999:mfa/mfa-device", "MFAUsed": "Yes" }, "eventID": "e1f76697-5beb-46e8-9cfc-EXAMPLEbde31", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "999999999999", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "us-east-1.signin.aws.amazon.com" } }

IAM user, unsuccessful sign-in

The following record shows an unsuccessful sign-in attempt from an IAM user named Paulo.

{ "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "EXAMPLE6E4XEGITWATV6R", "accountId": "123456789012", "accessKeyId": "", "userName": "Paulo" }, "eventTime": "2023-07-19T22:01:20Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0", "errorMessage": "Failed authentication", "requestParameters": null, "responseElements": { "ConsoleLogin": "Failure" }, "additionalEventData": { "LoginTo": "https://console.aws.amazon.com/console/home?hashArgs=%23&isauthcode=true&state=hashArgsFromTB_us-east-1_examplebde32f3c9", "MobileVersion": "No", "MFAUsed": "Yes" }, "eventID": "66c97220-2b7d-43b6-a7a0-EXAMPLEbae9c", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "123456789012", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "us-east-1.signin.aws.amazon.com" } }

IAM user, sign-in process checks for MFA (single MFA device type)

The following shows that the sign-process checked whether multi-factor authentication (MFA) is required for an IAM user during sign-in. In this example, the mfaType value is U2F MFA, which indicates that the IAM user enabled either a single MFA device or multiple MFA devices of the same type (U2F MFA).

{ "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "EXAMPLE6E4XEGITWATV6R", "accountId": "123456789012", "accessKeyId": "", "userName": "Alice" }, "eventTime": "2023-07-19T22:01:26Z", "eventSource": "signin.amazonaws.com", "eventName": "CheckMfa", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0", "requestParameters": null, "responseElements": { "CheckMfa": "Success" }, "additionalEventData": { "MfaType": "Virtual MFA" }, "eventID": "7d8a0746-b2e7-44f5-9917-EXAMPLEfb77c", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "123456789012", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "us-east-1.signin.aws.amazon.com" } }

IAM user, sign-in process checks for MFA (multiple MFA device types)

The following shows that the sign-process checked whether multi-factor authentication (MFA) is required for an IAM user during sign-in. In this example, the mfaType value is Multiple MFA Devices, which indicates that the IAM user enabled multiple MFA device types.

{ "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "EXAMPLE6E4XEGITWATV6R", "accountId": "123456789012", "accessKeyId": "", "userName": "Mary" }, "eventTime": "2023-07-19T23:10:09Z", "eventSource": "signin.amazonaws.com", "eventName": "CheckMfa", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0", "requestParameters": null, "responseElements": { "CheckMfa": "Success" }, "additionalEventData": { "MfaType": "Multiple MFA Devices" }, "eventID": "19bd1a1c-76b1-4806-9d8f-EXAMPLE02a96", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "123456789012", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "signin.aws.amazon.com" } }

Example event records for root users

The following examples show event records for several root user sign-in scenarios. When you sign-in using the root user, CloudTrail records the ConsoleLogin event in us-east-1.

Root user, successful sign-in without MFA

The following shows a successful sign-in event for a root user not using multi-factor authentication (MFA).

{ "eventVersion": "1.08", "userIdentity": { "type": "Root", "principalId": "111122223333", "arn": "arn:aws:iam::111122223333:root", "accountId": "111122223333", "accessKeyId": "" }, "eventTime": "2023-07-12T13:35:31Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36", "requestParameters": null, "responseElements": { "ConsoleLogin": "Success" }, "additionalEventData": { "LoginTo": "https://console.aws.amazon.com/console/home?hashArgs=%23&isauthcode=true&nc2=h_ct&src=header-signin&state=hashArgsFromTB_ap-southeast-2_example80afacd389", "MobileVersion": "No", "MFAUsed": "No" }, "eventID": "4217cc13-7328-4820-a90c-EXAMPLE8002e6", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "111122223333", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "signin.aws.amazon.com" } }

Root user, successful sign-in with MFA

The following shows a successful sign-in event for a root user using multi-factor authentication (MFA).

{ "eventVersion": "1.08", "userIdentity": { "type": "Root", "principalId": "444455556666", "arn": "arn:aws:iam::444455556666:root", "accountId": "444455556666", "accessKeyId": "" }, "eventTime": "2023-07-13T03:04:43Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36", "requestParameters": null, "responseElements": { "ConsoleLogin": "Success" }, "additionalEventData": { "LoginTo": "https://ap-southeast-1.console.aws.amazon.com/ec2/home?region=ap-southeast-1&state=hashArgs%23Instances%3Av%3D3%3B%24case%3Dtags%3Atrue%255C%2Cclient%3Afalse%3B%24regex%3Dtags%3Afalse%255C%2Cclient%3Afalse&isauthcode=true", "MobileVersion": "No", "MFAIdentifier": "arn:aws:iam::444455556666:mfa/root-account-mfa-device", "MFAUsed": "Yes" }, "eventID": "e0176723-ea76-4275-83a3-EXAMPLEf03fb", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "444455556666", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "signin.aws.amazon.com" } }

Root user, unsuccessful sign-in

The following shows an unsuccessful sign-in event for a root user not using MFA.

{ "eventVersion": "1.08", "userIdentity": { "type": "Root", "principalId": "123456789012", "arn": "arn:aws:iam::123456789012:root", "accountId": "123456789012", "accessKeyId": "" }, "eventTime": "2023-07-16T04:33:40Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36", "errorMessage": "Failed authentication", "requestParameters": null, "responseElements": { "ConsoleLogin": "Failure" }, "additionalEventData": { "LoginTo": "https://us-east-1.console.aws.amazon.com/billing/home?region=us-east-1&state=hashArgs%23%2Faccount&isauthcode=true", "MobileVersion": "No", "MFAUsed": "No" }, "eventID": "f28d4329-5050-480b-8de0-EXAMPLE07329", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "123456789012", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "signin.aws.amazon.com" } }

Root user, MFA changed

The following shows an example event for a root user changing multi-factor authentication (MFA) settings.

{ "eventVersion": "1.08", "userIdentity": { "type": "Root", "principalId": "111122223333", "arn": "arn:aws:iam::111122223333:root", "accountId": "111122223333", "accessKeyId": "EXAMPLE4XX3IEV4PFQTH", "userName": "Amazon ROOT USER", "sessionContext": { "sessionIssuer": {}, "webIdFederationData": {}, "attributes": { "creationDate": "2023-07-15T03:51:12Z", "mfaAuthenticated": "false" } } }, "eventTime": "2023-07-15T04:37:08Z", "eventSource": "iam.amazonaws.com", "eventName": "EnableMFADevice", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36", "requestParameters": { "userName": "Amazon ROOT USER", "serialNumber": "arn:aws:iam::111122223333:mfa/root-account-mfa-device" }, "responseElements": null, "requestID": "9b45cd4c-a598-41e7-9170-EXAMPLE535f0", "eventID": "b4f18d55-d36f-49a0-afcb-EXAMPLEc026b", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111122223333", "eventCategory": "Management", "sessionCredentialFromConsole": "true" }

Root user, password changed

The following shows an example event for a root user changing their password.

{ "eventVersion": "1.08", "userIdentity": { "type": "Root", "principalId": "444455556666", "arn": "arn:aws:iam::444455556666:root", "accountId": "444455556666", "accessKeyId": "EXAMPLEAOTKEG44KPW5P", "sessionContext": { "sessionIssuer": {}, "webIdFederationData": {}, "attributes": { "creationDate": "2022-11-25T13:01:14Z", "mfaAuthenticated": "false" } } }, "eventTime": "2022-11-25T13:01:14Z", "eventSource": "iam.amazonaws.com", "eventName": "ChangePassword", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36", "requestParameters": null, "responseElements": null, "requestID": "c64254c2-e4ff-49c0-900e-EXAMPLE9e6d2", "eventID": "d059176c-4f4d-4a9e-b8d7-EXAMPLE2b7b3", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "444455556666", "eventCategory": "Management" }

Example event records for federated users

The following examples show event records for federated users. Federated users are given temporary security credentials to access Amazon resources through an AssumeRole request.

The following shows an example event for a federation encryption request. The original access key ID is provided in the accessKeyId field of the userIdentity element. The accessKeyId field in the responseElements contains a new access key ID if the requested sessionDuration is passed in the encryption request, otherwise it contains the value of the original access key ID.

{ "eventVersion": "1.08", "userIdentity": { "type": "AssumedRole", "principalId": "EXAMPLEUU4MH7OYK5ZCOA:JohnDoe", "arn": "arn:aws:sts::123456789012:assumed-role/roleName/JohnDoe", "accountId": "123456789012", "accessKeyId": "originalAccessKeyID", "sessionContext": { "sessionIssuer": { "type": "Role", "principalId": "EXAMPLEUU4MH7OYK5ZCOA", "arn": "arn:aws:iam::123456789012:role/roleName", "accountId": "123456789012", "userName": "roleName" }, "webIdFederationData": {}, "attributes": { "creationDate": "2023-09-25T21:30:39Z", "mfaAuthenticated": "false" } } }, "eventTime": "2023-09-25T21:30:39Z", "eventSource": "signin.amazonaws.com", "eventName": "GetSigninToken", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Java/1.8.0_382", "requestParameters": null, "responseElements": { "credentials": { "accessKeyId": "accessKeyID" }, "GetSigninToken": "Success" }, "additionalEventData": { "MobileVersion": "No", "MFAUsed": "No" }, "eventID": "1d66615b-a417-40da-a38e-EXAMPLE8c89b", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "123456789012", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "us-east-1.signin.aws.amazon.com" } }

The following shows a successful sign-in event for a federated user; not using multi-factor authentication (MFA).

{ "eventVersion": "1.08", "userIdentity": { "type": "AssumedRole", "principalId": "EXAMPLEPHCNW7ZCASLJOH:JohnDoe", "arn": "arn:aws:sts::123456789012:assumed-role/RoleName/JohnDoe", "accountId": "123456789012", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "sessionContext": { "sessionIssuer": { "type": "Role", "principalId": "EXAMPLEPHCNW7ZCASLJOH", "arn": "arn:aws:iam::123456789012:role/RoleName", "accountId": "123456789012", "userName": "RoleName" }, "webIdFederationData": {}, "attributes": { "creationDate": "2023-09-22T16:15:47Z", "mfaAuthenticated": "false" } } }, "eventTime": "2023-09-22T16:15:47Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36", "requestParameters": null, "responseElements": { "ConsoleLogin": "Success" }, "additionalEventData": { "MobileVersion": "No", "MFAUsed": "No" }, "eventID": "b73f1ec6-c064-4cd3-ba83-EXAMPLE441d7", "readOnly": false, "eventType": "AwsConsoleSignIn", "managementEvent": true, "recipientAccountId": "123456789012", "eventCategory": "Management", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "us-east-1.signin.aws.amazon.com" } }