AOA questions 20/06/2023-23/06/2023

1. Does CloudTrail log include resource Tag information?
There is resource ID but no Tag information in CloudTrail (ex. StopInstances), but you can retrieve tags with resource ID

ex. AWS SDK to retrieve tags in Python

import boto3

# Create an AWS SDK client for the desired service
client = boto3.client('ec2') # Example for EC2, replace with the appropriate service

# Specify the resource identifier
resource_id = 'your-resource-id' # Replace with the actual resource ID

# Retrieve the tags for the resource
response = client.describe_tags(Filters=[{'Name': 'resource-id', 'Values': [resource_id]}])

# Extract the tags from the response
tags = response['Tags']

# Print the tags
for tag in tags:
print(f"Key: {tag['Key']}, Value: {tag['Value']}")

CloudTrail Json:
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "xxxx",
"arn": "arn:aws:iam::xxxx:user/testli1",
"accountId": "xxxx",
"accessKeyId": "xxxx",
"userName": "testli1",
"sessionContext": {
"sessionIssuer": {},
"webIdFederationData": {},
"attributes": {
"creationDate": "2023-06-21T16:25:47Z",
"mfaAuthenticated": "true"
}
}
},
"eventTime": "2023-06-21T16:28:19Z",
"eventSource": "ec2.amazonaws.com",
"eventName": "StopInstances",
"awsRegion": "eu-west-3",
"sourceIPAddress": "x.x.x.x",
"userAgent": "AWS Internal",
"requestParameters": {
"instancesSet": {
"items": [
{
"instanceId": "i-xxxx"
}
]
},
"force": false
},
"responseElements": {
"requestId": "xxxx-d3db-4052-8952-xxxx",
"instancesSet": {
"items": [
{
"instanceId": "i-xxxx",
"currentState": {
"code": 64,
"name": "stopping"
},
"previousState": {
"code": 16,
"name": "running"
}
}
]
}
},
"requestID": "xxxx-d3db-4052-8952-xxxx",
"eventID": "xxxx-42fa-4006-9edd-xxxx",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "xxxx",
"eventCategory": "Management",
"sessionCredentialFromConsole": "true"
}