CloudTrail Event - RunInstances

event.json

{
  "Records": [
    {
      "eventVersion": "1.05",
      "userIdentity": {
        "type": "AssumedRole",
        "principalId": "AROAISWA7TXBQT4XOO2X6:[email protected]",
        "arn": "arn:aws:sts::1234:assumed-role/[email protected]",
        "accountId": "1234",
        "accessKeyId": "ASIAZVE7HIYF3KVNS46V",
        "sessionContext": {
          "sessionIssuer": {
            "type": "Role",
            "principalId": "AROAISWA7TXBQT4XOO2X6",
            "arn": "arn:aws:iam::663206341083:role/admin",
            "accountId": "1234",
            "userName": "admin"
          },
          "webIdFederationData": {},
          "attributes": {
            "mfaAuthenticated": "false",
            "creationDate": "2020-02-11T14:29:40Z"
          }
        }
      },
      "eventTime": "2020-02-11T19:38:48Z",
      "eventSource": "ec2.amazonaws.com",
      "eventName": "RunInstances",
      "awsRegion": "us-east-1",
      "sourceIPAddress": "123.45.678.90",
      "userAgent": "console.ec2.amazonaws.com",
      "requestParameters": {
        "instancesSet": {
          "items": [
            {
              "imageId": "ami-062f7200baf2fa504",
              "minCount": 1,
              "maxCount": 1,
              "keyName": "my-pem"
            }
          ]
        },
        "instanceType": "t2.micro",
        "tenancy": "default",
        "monitoring": {
          "enabled": false
        },
        "disableApiTermination": false,
        "instanceInitiatedShutdownBehavior": "stop",
        "ebsOptimized": false,
        "creditSpecification": {
          "cpuCredits": "standard"
        },
        "capacityReservationSpecification": {
          "capacityReservationPreference": "open"
        }
      }
      "requestID": "a32479c8-822f-4039-a7dc-4fdadff9c11c",
      "eventID": "2236e5e0-7625-4769-a0bb-62a4c763961d",
      "eventType": "AwsApiCall",
      "recipientAccountId": "1234567"
    }
  ]
}