AWS awscloudtrail: Document BuilderIdUser identity type in CloudTrail events
Summary
Adds documentation and examples for the new `BuilderIdUser` userIdentity type, including its `onBehalfOf` fields, absence of `accountId`, and updated `onBehalfOf` attribute descriptions for IAM Identity Center and AWS Builder ID users.
Security assessment
The change documents how a new identity type (BuilderIdUser) appears in CloudTrail audit events, including the onBehalfOf userId/identityStoreArn fields used to attribute API activity. This improves audit/forensic visibility of bearer-token authenticated requests but does not fix a specific vulnerability.
Evidence
+ "type": "BuilderIdUser",
Diff
diff --git a/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.md b/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.md index 7a9c1f2..7239cd8 100644 --- a//awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.md +++ b//awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.md @@ -85,0 +86,18 @@ To learn more about how you can use `userId`, `identityStoreArn`, and `credentia +###### `userIdentity` for a request made by an AWS Builder ID user + +The following example shows a `userIdentity` element for a request made by an [AWS Builder ID](https://docs.aws.amazon.com/signin/latest/userguide/sign-in-aws_builder_id.html) user. AWS Builder ID is a personal profile that provides access to select tools and services including AWS Builder Center, Amazon Q Developer, and AWS Training and Certification. The `BuilderIdUser` type appears in CloudTrail events when an API request is authorized using an IAM Identity Center OAuth-issued access token (bearer authentication). This token is associated with an AWS Builder ID. + + + "userIdentity": { + "type": "BuilderIdUser", + "onBehalfOf": { + "userId": "544894e8-80c1-707f-60e3-3ba6510dfac1", + "identityStoreArn": "arn:aws:identitystore::aws:identitystore/builderid" + }, + "credentialId": "ABCDefGhiJKLMn11Lmn_1AbCDEFgHijk-AaBCdEFGHIjKLmnOPqrs11abEXAMPLE" + } + +Unlike `IdentityCenterUser` events, `BuilderIdUser` events do not include an `accountId` field because AWS Builder ID is an AWS-managed identity that is not associated with a specific customer AWS account. + +For more information about AWS Builder ID, see [Sign in with AWS Builder ID](https://docs.aws.amazon.com/signin/latest/userguide/sign-in-aws_builder_id.html) in the _AWS Sign-In User Guide_. + @@ -148,0 +167,2 @@ For more information about temporary security credentials, see [Temporary Securi + * `BuilderIdUser` – The request was made by an AWS Builder ID user. Unlike `IdentityCenterUser`, the `BuilderIdUser` type does not include an `accountId` field because AWS Builder ID is an AWS-managed identity not bound to a specific customer account. + @@ -196,0 +217 @@ The friendly name of the identity that made the call. The value that appears in +`BuilderIdUser` | Not present | The `onBehalfOf` section contains the Builder ID user's `userId` and the AWS-managed `identityStoreArn` (`arn:aws:identitystore::aws:identitystore/builderid`). Use these fields to identify the Builder ID user. @@ -234,0 +256,4 @@ If the request was made with an IAM Identity Center authorized access token, thi +###### Note + +For `BuilderIdUser` type events, the `accountId` field is not present. AWS Builder ID is an AWS-managed identity that is not associated with a specific customer AWS account. The `onBehalfOf` element identifies the Builder ID user instead. + @@ -327 +352 @@ For more information and a JSON example of delegated access in CloudTrail events -If the request was made by an IAM Identity Center caller, `onBehalfOf` provides information about the IAM Identity Center user ID and identity store ARN for which the call was made. This element has the following attributes: +If the request was made by an IAM Identity Center caller or an AWS Builder ID user, `onBehalfOf` provides information about the user on whose behalf the call was made. This element has the following attributes: @@ -329 +354 @@ If the request was made by an IAM Identity Center caller, `onBehalfOf` provides - * `userId` – The ID of the IAM Identity Center user who the call was made on behalf of. + * `userId` – The ID of the IAM Identity Center user or AWS Builder ID user on whose behalf the call was made. @@ -331 +356 @@ If the request was made by an IAM Identity Center caller, `onBehalfOf` provides - * `identityStoreArn` – The ARN of the IAM Identity Center identity store that the call was made on behalf of. + * `identityStoreArn` – The ARN of the identity store. For IAM Identity Center users, this is the ARN of the organization's identity store. For AWS Builder ID users, the value is `arn:aws:identitystore::aws:identitystore/builderid`.