AWS IAM Roles Anywhere

eventName	Description	Sample	Rule
any	Catch-all entry for AWS IAM Roles Anywhere rules that match the service but not a specific eventName.	N	N
CreateProfile	Creates a profile in IAM Roles Anywhere that defines which roles external workloads may assume and under what conditions.	Y	Y
CreateTrustAnchor	Creates a trust anchor to establish trust between IAM Roles Anywhere and a certificate authority (CA).	Y	Y
DeleteAttributeMapping	Delete an entry from the attribute mapping rules enforced by a given profile.	Y	N
DeleteCrl	Deletes a certificate revocation list (CRL).	N	N
DeleteProfile	Deletes a profile.	Y	N
DeleteTrustAnchor	Deletes a trust anchor.	Y	N
DisableCrl	Disables a certificate revocation list (CRL).	N	N
DisableProfile	Disables a profile.	Y	N
DisableTrustAnchor	Disables a trust anchor.	N	N
EnableCrl	Enables a certificate revocation list (CRL).	N	N
EnableProfile	Enables temporary credential requests for a profile.	Y	N
EnableTrustAnchor	Enables a trust anchor.	N	N
GetCrl	Gets a certificate revocation list (CRL).	N	N
GetProfile	Gets a profile.	N	N
GetSubject	Gets a subject, which associates a certificate identity with authentication attempts.	N	N
GetTrustAnchor	Gets a trust anchor.	N	N
ImportCrl	Imports the certificate revocation list (CRL).	N	N
ListCrls	Lists all certificate revocation lists (CRL) in the authenticated account and Amazon Web Services Region.	Y	N
ListProfiles	Lists all profiles in the authenticated account and Amazon Web Services Region.	Y	N
ListSubjects	Lists the subjects in the authenticated account and Amazon Web Services Region.	Y	N
ListTagsForResource	Lists the tags attached to the resource.	N	N
ListTrustAnchors	Lists the trust anchors in the authenticated account and Amazon Web Services Region.	Y	N
PutAttributeMapping	Put an entry in the attribute mapping rules that will be enforced by a given profile.	Y	N
PutNotificationSettings	Attaches a list of notification settings to a trust anchor.	N	N
ResetNotificationSettings	Resets the custom notification setting to IAM Roles Anywhere default setting.	N	N
TagResource	Attaches tags to a resource.	N	N
UntagResource	Removes tags from the resource.	N	N
UpdateCrl	Updates the certificate revocation list (CRL).	N	N
UpdateProfile	Updates a profile, a list of the roles that IAM Roles Anywhere service is trusted to assume.	Y	N
UpdateTrustAnchor	Updates a trust anchor.	N	N

any: AWS IAM Roles Anywhere (catch-all)

Service: rolesanywhere

Description

Catch-all entry for AWS IAM Roles Anywhere rules that match the service but not a specific eventName.

CreateProfile

Service: rolesanywhere

Description

Creates a profile in IAM Roles Anywhere that defines which roles external workloads may assume and under what conditions.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "782bc4f5-53eb-4072-ac09-070425df6eef",
  "eventName": "CreateProfile",
  "eventSource": "rolesanywhere.amazonaws.com",
  "eventTime": "2023-07-10T12:27:13Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123837392027",
  "requestID": "10a95e85-a0a2-4fc5-bf32-129a98e8f7c9",
  "requestParameters": {
    "durationSeconds": 3600,
    "enabled": true,
    "name": "malicious-rolesanywhere-profile",
    "roleArns": [
      "arn:aws:iam::123837392027:role/stratus-red-team-trust-anchor-role"
    ],
    "tags": [
      {
        "key": "HIDDEN_DUE_TO_SECURITY_REASONS",
        "value": "HIDDEN_DUE_TO_SECURITY_REASONS"
      }
    ]
  },
  "responseElements": {
    "profile": {
      "createdAt": "2023-07-10T12:27:13.431264Z",
      "createdBy": "arn:aws:iam::123837392027:user/bert-jan",
      "durationSeconds": 3600,
      "enabled": true,
      "name": "malicious-rolesanywhere-profile",
      "profileArn": "arn:aws:rolesanywhere:us-east-1:123837392027:profile/ac4e09d1-a150-4924-bb76-23b00fa7c34a",
      "profileId": "ac4e09d1-a150-4924-bb76-23b00fa7c34a",
      "roleArns": [
        "arn:aws:iam::123837392027:role/stratus-red-team-trust-anchor-role"
      ],
      "updatedAt": "2023-07-10T12:27:13.431264Z"
    }
  },
  "sourceIPAddress": "192.168.10.20",
  "tlsDetails": {
    "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
    "clientProvidedHostHeader": "rolesanywhere.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.2"
  },
  "userAgent": "stratus-red-team_d42001c7-3946-4d49-903d-c68f835109a3",
  "userIdentity": {
    "accessKeyId": "AKIATFQR7NSC8Q4X20BJ",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS IAM Roles Anywhere Profile Creation source high: Detects the creation of a new AWS IAM Roles Anywhere profile. Roles Anywhere allows workloads or external systems to assume IAM roles from outside AWS by authenticating via trusted certificate authorities (trust anchors). Adversaries who have established persistence through a rogue trust anchor may create or modify profiles to link them with highly privileged roles, enabling long-term external access to the AWS environment. This rule identifies successful "CreateProfile" API calls and helps detect potentially unauthorized or risky external access configurations.T1098, T1098.003

References #

Sample log: invictus-ir/aws_dataset

CreateTrustAnchor

Service: rolesanywhere

Description

Creates a trust anchor to establish trust between IAM Roles Anywhere and a certificate authority (CA).

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "2950830a-24ae-4565-bfab-74d3be4ad0d0",
  "eventName": "CreateTrustAnchor",
  "eventSource": "rolesanywhere.amazonaws.com",
  "eventTime": "2023-07-10T12:27:13Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123837392027",
  "requestID": "cf8e07a1-8680-4cd9-8f3c-b84433683602",
  "requestParameters": {
    "enabled": true,
    "name": "malicious-rolesanywhere-trust-anchor",
    "source": {
      "sourceData": {
        "x509CertificateData": "-----BEGIN CERTIFICATE-----\nMIIE3zCCAsegAwIBAgIJAOZLUn/n7YvYMA0GCSqGSIb3DQEBCwUAMA0xCzAJBgNV\nBAYTAkVTMB4XDTIyMDcxMDIxMjgxOVoXDTMyMDcwNzIxMjgxOVowDTELMAkGA1UE\nBhMCRVMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDb0ga7LzegYNXV\noBTY7ByNCtgqAEoZVQAEQAxpWzK4wL4V+TKRRGiP9KQSbMsU35dBuxzg2Ih62dwr\nh6S7vYX4eU8YpGcutrWekzAl+G4GwfbHcwJYt9ALrneFUUWEedYA6BTVG0b+cwIL\nOkVJSlB/4bAVFocwafdnFi3CLsIhXF/Yn90mnug+qsXSWPMZmTXaykiO9+AWV/pO\n/JNS2WLPp4EKUT3CGm12TxBMHG0sWG0xopuj4KXTsyJFELDevSo92ldqyCIJFgG8\nwBmbETxx9TlTPEU6hVkG4MLE2ekkEQK8WVLpZvTGFRrauawMhAzfFV9ZcgIsURy7\nv2/FlYL7OedesimPfGD8M1dkm4yK2dVvUf/HyEL1IB1+3NtAOoifZ5jBBJKaybF0\n/W85asZWVg+yKokFhmQRzu4BFnPhsoTwau+WuySYokbWIEzdW8FljWpwiPlvnqy+\nVJVKdZuzWx12yLzK5srQ4Qcb/tQqkooVASM0PH5ts3PYlf5hRgxqKgCR5lXODxoA\n0aylk6+wC2oBLhvufmwObsOMcxMbPv+EQvzYChL1MRLvEPAmATiE64ZLn8IOu9MG\n9GRC6D/NkLy9LdsPWfzx+W1itrWR3ft/uD/HXILAVc54HejbZGsPsLe7qITDNc7n\nD5zM+orgu67zgRaBOm1kPZbr/vHUFQIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAYYw\nHQYDVR0OBBYEFJNT8WprixUiturSY9GAHXmAcP/RMA8GA1UdEwEB/wQFMAMBAf8w\nDQYJKoZIhvcNAQELBQADggIBAJ1clg4GzHuMxTmpz+riL2klUZEMpJPvy682c0iH\nNlG0f30cNHdSlnhCnx78h3n1xotSM8zZf6+LepCZWCzho5p3Fep7sDumQ+chgdIp\nNApgcGX7tpx+TVjrrwkpxioMSfVFHJ7RMSewumnOXw4NsUQmGJdku8FUR7BWRRiY\nfk0MoQ9nuwjt+RcSz/IKdFTzjI70nPikjSSd0L/ovWk5aXgLcnZpgzv6r4HbafJU\n7dEnP+paZugEUts+SNXr3vkSuiLod7iiOcmQFvtRDFUAn4QonoN/6lDDOGLYsy0J\nrv9GI+Y5VYt6JRGNJq/yCBV1KhhjaWll0kl/UNxIr+hBQ5Vul9SiR3jbbNlRh1PE\nMPEAzhcqG8i3oZwwl62pjqPja+EvSuoPHf0tJ1rmjWmBt3irShSnuFN69+E4h20d\n2cHVyF4GqF2VdNPYa0lh0cSIsNCJJ5+eyXRHKPcUCKI7pDYdbKZt+8ILlZC5PsSK\nC0XsWIzqSG69Uqkm8c0P07NPmcAnGC3O92uhOrb4ytC2KyHVrNa+Bs6VYlYr3ayq\n5AVfJZGuSxldlyM0N/peEKqz9vok4FoBxxSZGDi9ZDIMjLTpypHOMXi0d8YcClFO\nlmRijJoUF95T+svxE60fdndPlleDKC8OnxvcIbS4OSK0ZqK1SFgTNaIgOniUSY6Q\nV0KM\n-----END CERTIFICATE-----"
      },
      "sourceType": "CERTIFICATE_BUNDLE"
    },
    "tags": [
      {
        "key": "HIDDEN_DUE_TO_SECURITY_REASONS",
        "value": "HIDDEN_DUE_TO_SECURITY_REASONS"
      }
    ]
  },
  "responseElements": {
    "trustAnchor": {
      "createdAt": "2023-07-10T12:27:13.230465Z",
      "enabled": true,
      "name": "malicious-rolesanywhere-trust-anchor",
      "notificationSettings": [
        {
          "channel": "ALL",
          "configuredBy": "rolesanywhere.amazonaws.com",
          "enabled": true,
          "event": "CA_CERTIFICATE_EXPIRY",
          "threshold": 45
        },
        {
          "channel": "ALL",
          "configuredBy": "rolesanywhere.amazonaws.com",
          "enabled": true,
          "event": "END_ENTITY_CERTIFICATE_EXPIRY",
          "threshold": 45
        }
      ],
      "source": {
        "sourceData": {
          "x509CertificateData": "-----BEGIN CERTIFICATE-----\nMIIE3zCCAsegAwIBAgIJAOZLUn/n7YvYMA0GCSqGSIb3DQEBCwUAMA0xCzAJBgNV\nBAYTAkVTMB4XDTIyMDcxMDIxMjgxOVoXDTMyMDcwNzIxMjgxOVowDTELMAkGA1UE\nBhMCRVMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDb0ga7LzegYNXV\noBTY7ByNCtgqAEoZVQAEQAxpWzK4wL4V+TKRRGiP9KQSbMsU35dBuxzg2Ih62dwr\nh6S7vYX4eU8YpGcutrWekzAl+G4GwfbHcwJYt9ALrneFUUWEedYA6BTVG0b+cwIL\nOkVJSlB/4bAVFocwafdnFi3CLsIhXF/Yn90mnug+qsXSWPMZmTXaykiO9+AWV/pO\n/JNS2WLPp4EKUT3CGm12TxBMHG0sWG0xopuj4KXTsyJFELDevSo92ldqyCIJFgG8\nwBmbETxx9TlTPEU6hVkG4MLE2ekkEQK8WVLpZvTGFRrauawMhAzfFV9ZcgIsURy7\nv2/FlYL7OedesimPfGD8M1dkm4yK2dVvUf/HyEL1IB1+3NtAOoifZ5jBBJKaybF0\n/W85asZWVg+yKokFhmQRzu4BFnPhsoTwau+WuySYokbWIEzdW8FljWpwiPlvnqy+\nVJVKdZuzWx12yLzK5srQ4Qcb/tQqkooVASM0PH5ts3PYlf5hRgxqKgCR5lXODxoA\n0aylk6+wC2oBLhvufmwObsOMcxMbPv+EQvzYChL1MRLvEPAmATiE64ZLn8IOu9MG\n9GRC6D/NkLy9LdsPWfzx+W1itrWR3ft/uD/HXILAVc54HejbZGsPsLe7qITDNc7n\nD5zM+orgu67zgRaBOm1kPZbr/vHUFQIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAYYw\nHQYDVR0OBBYEFJNT8WprixUiturSY9GAHXmAcP/RMA8GA1UdEwEB/wQFMAMBAf8w\nDQYJKoZIhvcNAQELBQADggIBAJ1clg4GzHuMxTmpz+riL2klUZEMpJPvy682c0iH\nNlG0f30cNHdSlnhCnx78h3n1xotSM8zZf6+LepCZWCzho5p3Fep7sDumQ+chgdIp\nNApgcGX7tpx+TVjrrwkpxioMSfVFHJ7RMSewumnOXw4NsUQmGJdku8FUR7BWRRiY\nfk0MoQ9nuwjt+RcSz/IKdFTzjI70nPikjSSd0L/ovWk5aXgLcnZpgzv6r4HbafJU\n7dEnP+paZugEUts+SNXr3vkSuiLod7iiOcmQFvtRDFUAn4QonoN/6lDDOGLYsy0J\nrv9GI+Y5VYt6JRGNJq/yCBV1KhhjaWll0kl/UNxIr+hBQ5Vul9SiR3jbbNlRh1PE\nMPEAzhcqG8i3oZwwl62pjqPja+EvSuoPHf0tJ1rmjWmBt3irShSnuFN69+E4h20d\n2cHVyF4GqF2VdNPYa0lh0cSIsNCJJ5+eyXRHKPcUCKI7pDYdbKZt+8ILlZC5PsSK\nC0XsWIzqSG69Uqkm8c0P07NPmcAnGC3O92uhOrb4ytC2KyHVrNa+Bs6VYlYr3ayq\n5AVfJZGuSxldlyM0N/peEKqz9vok4FoBxxSZGDi9ZDIMjLTpypHOMXi0d8YcClFO\nlmRijJoUF95T+svxE60fdndPlleDKC8OnxvcIbS4OSK0ZqK1SFgTNaIgOniUSY6Q\nV0KM\n-----END CERTIFICATE-----\n"
        },
        "sourceType": "CERTIFICATE_BUNDLE"
      },
      "trustAnchorArn": "arn:aws:rolesanywhere:us-east-1:123837392027:trust-anchor/49e25ec3-bdfe-4150-8683-b4ea4ee85cfd",
      "trustAnchorId": "49e25ec3-bdfe-4150-8683-b4ea4ee85cfd",
      "updatedAt": "2023-07-10T12:27:13.230465Z"
    }
  },
  "sourceIPAddress": "192.168.10.20",
  "tlsDetails": {
    "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
    "clientProvidedHostHeader": "rolesanywhere.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.2"
  },
  "userAgent": "stratus-red-team_d42001c7-3946-4d49-903d-c68f835109a3",
  "userIdentity": {
    "accessKeyId": "AKIATFQR7NSC8Q4X20BJ",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

AWS IAM Roles Anywhere Trust Anchor Created with External CA source medium: Detects the creation of an AWS IAM Roles Anywhere Trust Anchor that uses an external certificate authority (CA) rather than an AWS-managed Certificate Manager Private CA (ACM PCA). While Roles Anywhere enables secure, short-term credential issuance for workloads outside AWS, adversaries can exploit this feature by registering their own external CA as a trusted root. This allows them to generate valid client certificates that persistently authenticate to AWS roles from any location, even after key rotation or credential revocation events. This rule helps detect persistence or unauthorized federation attempts by flagging trust anchors configured with non-AWS CAs.T1098, T1098.003, T1556

References #

Sample log: invictus-ir/aws_dataset

DeleteAttributeMapping

Service: rolesanywhere

Description

Delete an entry from the attribute mapping rules enforced by a given profile.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "fe63607f-2602-42e1-90f1-4cb9f8202db8",
  "eventName": "DeleteAttributeMapping",
  "eventSource": "rolesanywhere.amazonaws.com",
  "eventTime": "2026-06-29T21:06:46Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "6505b5eb-76ac-4754-bb1b-97fcc63d38ab",
  "requestParameters": {
    "certificateField": "x509Subject",
    "profileId": "e98c4d28-8b0f-4c5f-bd33-cc88c33b3d11",
    "specifiers": [
      "CN"
    ]
  },
  "responseElements": {
    "profile": {
      "acceptRoleSessionName": false,
      "attributeMappings": [
        {
          "certificateField": "x509Issuer",
          "mappingRules": [
            {
              "specifier": "*"
            }
          ]
        },
        {
          "certificateField": "x509SAN",
          "mappingRules": [
            {
              "specifier": "DNS"
            },
            {
              "specifier": "URI"
            },
            {
              "specifier": "Name/*"
            }
          ]
        }
      ],
      "createdAt": "2026-06-29T21:06:46.362284346Z",
      "createdBy": "arn:aws:iam::123456789012:user/sample-user",
      "durationSeconds": 3600,
      "enabled": true,
      "name": "dwfix-profile",
      "profileArn": "arn:aws:rolesanywhere:us-west-1:123456789012:profile/e98c4d28-8b0f-4c5f-bd33-cc88c33b3d11",
      "profileId": "e98c4d28-8b0f-4c5f-bd33-cc88c33b3d11",
      "roleArns": [
        "arn:aws:iam::123456789012:role/dwfix-ra-role"
      ],
      "updatedAt": "2026-06-29T21:06:46.617814685Z"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "rolesanywhere.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,n,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DeleteCrl

Service: rolesanywhere

Description

Deletes a certificate revocation list (CRL).

DeleteProfile

Service: rolesanywhere

Description

Deletes a profile.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "abca78f6-07bb-4517-9b5c-7a3bf8a65488",
  "eventName": "DeleteProfile",
  "eventSource": "rolesanywhere.amazonaws.com",
  "eventTime": "2023-07-10T12:28:24Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123837392027",
  "requestID": "22512888-cf03-422c-8252-1fe18491068d",
  "requestParameters": {
    "profileId": "ac4e09d1-a150-4924-bb76-23b00fa7c34a"
  },
  "responseElements": {
    "profile": {
      "createdAt": "2023-07-10T12:27:13.431264Z",
      "createdBy": "arn:aws:iam::123837392027:user/bert-jan",
      "durationSeconds": 3600,
      "enabled": true,
      "name": "malicious-rolesanywhere-profile",
      "profileArn": "arn:aws:rolesanywhere:us-east-1:123837392027:profile/ac4e09d1-a150-4924-bb76-23b00fa7c34a",
      "profileId": "ac4e09d1-a150-4924-bb76-23b00fa7c34a",
      "roleArns": [
        "arn:aws:iam::123837392027:role/stratus-red-team-trust-anchor-role"
      ],
      "updatedAt": "2023-07-10T12:27:13.431264Z"
    }
  },
  "sourceIPAddress": "192.168.10.20",
  "tlsDetails": {
    "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
    "clientProvidedHostHeader": "rolesanywhere.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.2"
  },
  "userAgent": "stratus-red-team_22fd7cec-81a8-4518-9133-fb57a8af00b8",
  "userIdentity": {
    "accessKeyId": "AKIATFQR7NSC8Q4X20BJ",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

References #

Sample log: invictus-ir/aws_dataset

DeleteTrustAnchor

Service: rolesanywhere

Description

Deletes a trust anchor.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "7663e5f0-fdb7-40ac-9186-47bdefbc26d5",
  "eventName": "DeleteTrustAnchor",
  "eventSource": "rolesanywhere.amazonaws.com",
  "eventTime": "2023-07-10T12:28:24Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123837392027",
  "requestID": "5ce1232d-7faf-4a42-9897-15dc23717d76",
  "requestParameters": {
    "trustAnchorId": "49e25ec3-bdfe-4150-8683-b4ea4ee85cfd"
  },
  "responseElements": {
    "trustAnchor": {
      "createdAt": "2023-07-10T12:27:13.230465Z",
      "enabled": true,
      "name": "malicious-rolesanywhere-trust-anchor",
      "notificationSettings": [
        {
          "channel": "ALL",
          "configuredBy": "rolesanywhere.amazonaws.com",
          "enabled": true,
          "event": "CA_CERTIFICATE_EXPIRY",
          "threshold": 45
        },
        {
          "channel": "ALL",
          "configuredBy": "rolesanywhere.amazonaws.com",
          "enabled": true,
          "event": "END_ENTITY_CERTIFICATE_EXPIRY",
          "threshold": 45
        }
      ],
      "source": {
        "sourceData": {
          "x509CertificateData": "-----BEGIN CERTIFICATE-----\nMIIE3zCCAsegAwIBAgIJAOZLUn/n7YvYMA0GCSqGSIb3DQEBCwUAMA0xCzAJBgNV\nBAYTAkVTMB4XDTIyMDcxMDIxMjgxOVoXDTMyMDcwNzIxMjgxOVowDTELMAkGA1UE\nBhMCRVMwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDb0ga7LzegYNXV\noBTY7ByNCtgqAEoZVQAEQAxpWzK4wL4V+TKRRGiP9KQSbMsU35dBuxzg2Ih62dwr\nh6S7vYX4eU8YpGcutrWekzAl+G4GwfbHcwJYt9ALrneFUUWEedYA6BTVG0b+cwIL\nOkVJSlB/4bAVFocwafdnFi3CLsIhXF/Yn90mnug+qsXSWPMZmTXaykiO9+AWV/pO\n/JNS2WLPp4EKUT3CGm12TxBMHG0sWG0xopuj4KXTsyJFELDevSo92ldqyCIJFgG8\nwBmbETxx9TlTPEU6hVkG4MLE2ekkEQK8WVLpZvTGFRrauawMhAzfFV9ZcgIsURy7\nv2/FlYL7OedesimPfGD8M1dkm4yK2dVvUf/HyEL1IB1+3NtAOoifZ5jBBJKaybF0\n/W85asZWVg+yKokFhmQRzu4BFnPhsoTwau+WuySYokbWIEzdW8FljWpwiPlvnqy+\nVJVKdZuzWx12yLzK5srQ4Qcb/tQqkooVASM0PH5ts3PYlf5hRgxqKgCR5lXODxoA\n0aylk6+wC2oBLhvufmwObsOMcxMbPv+EQvzYChL1MRLvEPAmATiE64ZLn8IOu9MG\n9GRC6D/NkLy9LdsPWfzx+W1itrWR3ft/uD/HXILAVc54HejbZGsPsLe7qITDNc7n\nD5zM+orgu67zgRaBOm1kPZbr/vHUFQIDAQABo0IwQDAOBgNVHQ8BAf8EBAMCAYYw\nHQYDVR0OBBYEFJNT8WprixUiturSY9GAHXmAcP/RMA8GA1UdEwEB/wQFMAMBAf8w\nDQYJKoZIhvcNAQELBQADggIBAJ1clg4GzHuMxTmpz+riL2klUZEMpJPvy682c0iH\nNlG0f30cNHdSlnhCnx78h3n1xotSM8zZf6+LepCZWCzho5p3Fep7sDumQ+chgdIp\nNApgcGX7tpx+TVjrrwkpxioMSfVFHJ7RMSewumnOXw4NsUQmGJdku8FUR7BWRRiY\nfk0MoQ9nuwjt+RcSz/IKdFTzjI70nPikjSSd0L/ovWk5aXgLcnZpgzv6r4HbafJU\n7dEnP+paZugEUts+SNXr3vkSuiLod7iiOcmQFvtRDFUAn4QonoN/6lDDOGLYsy0J\nrv9GI+Y5VYt6JRGNJq/yCBV1KhhjaWll0kl/UNxIr+hBQ5Vul9SiR3jbbNlRh1PE\nMPEAzhcqG8i3oZwwl62pjqPja+EvSuoPHf0tJ1rmjWmBt3irShSnuFN69+E4h20d\n2cHVyF4GqF2VdNPYa0lh0cSIsNCJJ5+eyXRHKPcUCKI7pDYdbKZt+8ILlZC5PsSK\nC0XsWIzqSG69Uqkm8c0P07NPmcAnGC3O92uhOrb4ytC2KyHVrNa+Bs6VYlYr3ayq\n5AVfJZGuSxldlyM0N/peEKqz9vok4FoBxxSZGDi9ZDIMjLTpypHOMXi0d8YcClFO\nlmRijJoUF95T+svxE60fdndPlleDKC8OnxvcIbS4OSK0ZqK1SFgTNaIgOniUSY6Q\nV0KM\n-----END CERTIFICATE-----\n"
        },
        "sourceType": "CERTIFICATE_BUNDLE"
      },
      "trustAnchorArn": "arn:aws:rolesanywhere:us-east-1:123837392027:trust-anchor/49e25ec3-bdfe-4150-8683-b4ea4ee85cfd",
      "trustAnchorId": "49e25ec3-bdfe-4150-8683-b4ea4ee85cfd",
      "updatedAt": "2023-07-10T12:27:13.230465Z"
    }
  },
  "sourceIPAddress": "192.168.10.20",
  "tlsDetails": {
    "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
    "clientProvidedHostHeader": "rolesanywhere.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.2"
  },
  "userAgent": "stratus-red-team_22fd7cec-81a8-4518-9133-fb57a8af00b8",
  "userIdentity": {
    "accessKeyId": "AKIATFQR7NSC8Q4X20BJ",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

References #

Sample log: invictus-ir/aws_dataset

DisableCrl

Service: rolesanywhere

Description

Disables a certificate revocation list (CRL).

DisableProfile

Service: rolesanywhere

Description

Disables a profile.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "5d229041-d384-40fb-95d8-f88596494dca",
  "eventName": "DisableProfile",
  "eventSource": "rolesanywhere.amazonaws.com",
  "eventTime": "2026-06-29T21:06:46Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "e46d7425-ea0c-4031-ac15-a3bec0ded8f1",
  "requestParameters": {
    "profileId": "e98c4d28-8b0f-4c5f-bd33-cc88c33b3d11"
  },
  "responseElements": {
    "profile": {
      "acceptRoleSessionName": false,
      "attributeMappings": [
        {
          "certificateField": "x509Issuer",
          "mappingRules": [
            {
              "specifier": "*"
            }
          ]
        },
        {
          "certificateField": "x509SAN",
          "mappingRules": [
            {
              "specifier": "DNS"
            },
            {
              "specifier": "URI"
            },
            {
              "specifier": "Name/*"
            }
          ]
        },
        {
          "certificateField": "x509Subject",
          "mappingRules": [
            {
              "specifier": "*"
            }
          ]
        }
      ],
      "createdAt": "2026-06-29T21:06:46.362284346Z",
      "createdBy": "arn:aws:iam::123456789012:user/sample-user",
      "durationSeconds": 3600,
      "enabled": false,
      "name": "dwfix-profile",
      "profileArn": "arn:aws:rolesanywhere:us-west-1:123456789012:profile/e98c4d28-8b0f-4c5f-bd33-cc88c33b3d11",
      "profileId": "e98c4d28-8b0f-4c5f-bd33-cc88c33b3d11",
      "roleArns": [
        "arn:aws:iam::123456789012:role/dwfix-ra-role"
      ],
      "updatedAt": "2026-06-29T21:06:46.440556885Z"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "rolesanywhere.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,n,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

DisableTrustAnchor

Service: rolesanywhere

Description

Disables a trust anchor.

EnableCrl

Service: rolesanywhere

Description

Enables a certificate revocation list (CRL).

EnableProfile

Service: rolesanywhere

Description

Enables temporary credential requests for a profile.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "d1f60e65-2bfb-40ee-8f11-4d4d4aaea97b",
  "eventName": "EnableProfile",
  "eventSource": "rolesanywhere.amazonaws.com",
  "eventTime": "2026-06-29T21:06:46Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "49edbd5d-2f59-4110-9c14-50a86e4528ed",
  "requestParameters": {
    "profileId": "e98c4d28-8b0f-4c5f-bd33-cc88c33b3d11"
  },
  "responseElements": {
    "profile": {
      "acceptRoleSessionName": false,
      "attributeMappings": [
        {
          "certificateField": "x509Issuer",
          "mappingRules": [
            {
              "specifier": "*"
            }
          ]
        },
        {
          "certificateField": "x509SAN",
          "mappingRules": [
            {
              "specifier": "DNS"
            },
            {
              "specifier": "URI"
            },
            {
              "specifier": "Name/*"
            }
          ]
        },
        {
          "certificateField": "x509Subject",
          "mappingRules": [
            {
              "specifier": "*"
            }
          ]
        }
      ],
      "createdAt": "2026-06-29T21:06:46.362284346Z",
      "createdBy": "arn:aws:iam::123456789012:user/sample-user",
      "durationSeconds": 3600,
      "enabled": true,
      "name": "dwfix-profile",
      "profileArn": "arn:aws:rolesanywhere:us-west-1:123456789012:profile/e98c4d28-8b0f-4c5f-bd33-cc88c33b3d11",
      "profileId": "e98c4d28-8b0f-4c5f-bd33-cc88c33b3d11",
      "roleArns": [
        "arn:aws:iam::123456789012:role/dwfix-ra-role"
      ],
      "updatedAt": "2026-06-29T21:06:46.505690928Z"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "rolesanywhere.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,n,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

EnableTrustAnchor

Service: rolesanywhere

Description

Enables a trust anchor.

GetCrl

Service: rolesanywhere

Description

Gets a certificate revocation list (CRL).

GetProfile

Service: rolesanywhere

Description

Gets a profile.

GetSubject

Service: rolesanywhere

Description

Gets a subject, which associates a certificate identity with authentication attempts.

GetTrustAnchor

Service: rolesanywhere

Description

Gets a trust anchor.

ImportCrl

Service: rolesanywhere

Description

Imports the certificate revocation list (CRL).

ListCrls

Service: rolesanywhere

Description

Lists all certificate revocation lists (CRL) in the authenticated account and Amazon Web Services Region.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "4b6d4971-94e5-4b45-a677-b575b2a9bcd4",
  "eventName": "ListCrls",
  "eventSource": "rolesanywhere.amazonaws.com",
  "eventTime": "2026-06-29T18:32:28Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "47593876-65b6-40b6-be38-35d237f46a09",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "rolesanywhere.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListProfiles

Service: rolesanywhere

Description

Lists all profiles in the authenticated account and Amazon Web Services Region.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "021598cc-a79a-483c-a8f7-221ffea429a9",
  "eventName": "ListProfiles",
  "eventSource": "rolesanywhere.amazonaws.com",
  "eventTime": "2023-07-10T12:28:24Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123837392027",
  "requestID": "ee358d8c-a431-4820-8fbc-70fc4e1459ab",
  "requestParameters": {
    "pageSize": 500
  },
  "responseElements": null,
  "sourceIPAddress": "192.168.10.20",
  "tlsDetails": {
    "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
    "clientProvidedHostHeader": "rolesanywhere.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.2"
  },
  "userAgent": "stratus-red-team_22fd7cec-81a8-4518-9133-fb57a8af00b8",
  "userIdentity": {
    "accessKeyId": "AKIATFQR7NSC8Q4X20BJ",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

References #

Sample log: invictus-ir/aws_dataset

ListSubjects

Service: rolesanywhere

Description

Lists the subjects in the authenticated account and Amazon Web Services Region.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "3c7ff720-e3b5-40f2-8667-b724c8a9125c",
  "eventName": "ListSubjects",
  "eventSource": "rolesanywhere.amazonaws.com",
  "eventTime": "2026-06-29T18:32:28Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123456789012",
  "requestID": "6a42fb82-4b42-47f1-92ac-18195cb62dd5",
  "requestParameters": null,
  "responseElements": null,
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "rolesanywhere.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/D,Z,b cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

ListTagsForResource

Service: rolesanywhere

Description

Lists the tags attached to the resource.

ListTrustAnchors

Service: rolesanywhere

Description

Lists the trust anchors in the authenticated account and Amazon Web Services Region.

Example CloudTrail Event #

{
  "awsRegion": "us-east-1",
  "eventCategory": "Management",
  "eventID": "5609d8e6-1852-4e9f-9f16-48f2bade8690",
  "eventName": "ListTrustAnchors",
  "eventSource": "rolesanywhere.amazonaws.com",
  "eventTime": "2023-07-10T12:28:24Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.08",
  "managementEvent": true,
  "readOnly": true,
  "recipientAccountId": "123837392027",
  "requestID": "106b8634-279e-4819-b07f-ea318ecf7333",
  "requestParameters": {
    "pageSize": 500
  },
  "responseElements": null,
  "sourceIPAddress": "192.168.10.20",
  "tlsDetails": {
    "cipherSuite": "ECDHE-RSA-AES128-GCM-SHA256",
    "clientProvidedHostHeader": "rolesanywhere.us-east-1.amazonaws.com",
    "tlsVersion": "TLSv1.2"
  },
  "userAgent": "stratus-red-team_22fd7cec-81a8-4518-9133-fb57a8af00b8",
  "userIdentity": {
    "accessKeyId": "AKIATFQR7NSC8Q4X20BJ",
    "accountId": "123837392027",
    "arn": "arn:aws:iam::123837392027:user/bert-jan",
    "principalId": "AIDATFQR7NSC5AU2ZV3IE",
    "type": "IAMUser",
    "userName": "bert-jan"
  }
}

References #

Sample log: invictus-ir/aws_dataset

PutAttributeMapping

Service: rolesanywhere

Description

Put an entry in the attribute mapping rules that will be enforced by a given profile.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "0e69feb5-fb9c-43c1-beaf-a3a5a3ef4e71",
  "eventName": "PutAttributeMapping",
  "eventSource": "rolesanywhere.amazonaws.com",
  "eventTime": "2026-06-29T21:06:46Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "25db1d09-55ec-426d-b80a-e970e43794f7",
  "requestParameters": {
    "certificateField": "x509Subject",
    "mappingRules": [
      {
        "specifier": "CN"
      }
    ],
    "profileId": "e98c4d28-8b0f-4c5f-bd33-cc88c33b3d11"
  },
  "responseElements": {
    "profile": {
      "acceptRoleSessionName": false,
      "attributeMappings": [
        {
          "certificateField": "x509Issuer",
          "mappingRules": [
            {
              "specifier": "*"
            }
          ]
        },
        {
          "certificateField": "x509SAN",
          "mappingRules": [
            {
              "specifier": "DNS"
            },
            {
              "specifier": "URI"
            },
            {
              "specifier": "Name/*"
            }
          ]
        },
        {
          "certificateField": "x509Subject",
          "mappingRules": [
            {
              "specifier": "CN"
            }
          ]
        }
      ],
      "createdAt": "2026-06-29T21:06:46.362284346Z",
      "createdBy": "arn:aws:iam::123456789012:user/sample-user",
      "durationSeconds": 3600,
      "enabled": true,
      "name": "dwfix-profile",
      "profileArn": "arn:aws:rolesanywhere:us-west-1:123456789012:profile/e98c4d28-8b0f-4c5f-bd33-cc88c33b3d11",
      "profileId": "e98c4d28-8b0f-4c5f-bd33-cc88c33b3d11",
      "roleArns": [
        "arn:aws:iam::123456789012:role/dwfix-ra-role"
      ],
      "updatedAt": "2026-06-29T21:06:46.563965057Z"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "rolesanywhere.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,n,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

PutNotificationSettings

Service: rolesanywhere

Description

Attaches a list of notification settings to a trust anchor.

ResetNotificationSettings

Service: rolesanywhere

Description

Resets the custom notification setting to IAM Roles Anywhere default setting.

TagResource

Service: rolesanywhere

Description

Attaches tags to a resource.

UntagResource

Service: rolesanywhere

Description

Removes tags from the resource.

UpdateCrl

Service: rolesanywhere

Description

Updates the certificate revocation list (CRL).

UpdateProfile

Service: rolesanywhere

Description

Updates a profile, a list of the roles that IAM Roles Anywhere service is trusted to assume.

Example CloudTrail Event #

{
  "awsRegion": "us-west-1",
  "eventCategory": "Management",
  "eventID": "8029cc70-bf1c-4786-94b8-201103afbac5",
  "eventName": "UpdateProfile",
  "eventSource": "rolesanywhere.amazonaws.com",
  "eventTime": "2026-06-29T21:06:46Z",
  "eventType": "AwsApiCall",
  "eventVersion": "1.11",
  "managementEvent": true,
  "readOnly": false,
  "recipientAccountId": "123456789012",
  "requestID": "e80453c5-a329-4c1b-98cf-cf0d46c9881b",
  "requestParameters": {
    "durationSeconds": 1800,
    "name": "dwfix-profile-v2",
    "profileId": "e98c4d28-8b0f-4c5f-bd33-cc88c33b3d11"
  },
  "responseElements": {
    "profile": {
      "acceptRoleSessionName": false,
      "attributeMappings": [
        {
          "certificateField": "x509Issuer",
          "mappingRules": [
            {
              "specifier": "*"
            }
          ]
        },
        {
          "certificateField": "x509SAN",
          "mappingRules": [
            {
              "specifier": "DNS"
            },
            {
              "specifier": "URI"
            },
            {
              "specifier": "Name/*"
            }
          ]
        }
      ],
      "createdAt": "2026-06-29T21:06:46.362284346Z",
      "createdBy": "arn:aws:iam::123456789012:user/sample-user",
      "durationSeconds": 1800,
      "enabled": true,
      "name": "dwfix-profile-v2",
      "profileArn": "arn:aws:rolesanywhere:us-west-1:123456789012:profile/e98c4d28-8b0f-4c5f-bd33-cc88c33b3d11",
      "profileId": "e98c4d28-8b0f-4c5f-bd33-cc88c33b3d11",
      "roleArns": [
        "arn:aws:iam::123456789012:role/dwfix-ra-role"
      ],
      "updatedAt": "2026-06-29T21:06:46.670619421Z"
    }
  },
  "sourceIPAddress": "203.0.113.5",
  "tlsDetails": {
    "cipherSuite": "TLS_AES_128_GCM_SHA256",
    "clientProvidedHostHeader": "rolesanywhere.us-west-1.amazonaws.com",
    "tlsVersion": "TLSv1.3"
  },
  "userAgent": "Boto3/1.43.36 md/Botocore#1.43.36 ua/2.1 os/linux#6.1.0-41-amd64 md/arch#x86_64 lang/python#3.11.2 md/pyimpl#CPython m/b,Z,n,D cfg/retry-mode#legacy Botocore/1.43.36",
  "userIdentity": {
    "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
    "accountId": "123456789012",
    "arn": "arn:aws:iam::123456789012:user/sample-user",
    "principalId": "AIDAEXAMPLE00000000",
    "type": "IAMUser",
    "userName": "sample-user"
  }
}

UpdateTrustAnchor

Service: rolesanywhere

Description

Updates a trust anchor.