elastic / elastic/integrations

[AWS-CloudTrail]: Missing 'userIdentity.identityProvider' field from AssumeRoleWithWebIdentity events

Open
#18,396 2 comments 0 reactions 0 assignees View on GitHub
Integration:aws_cloudtrail_otel needs:triage Team:Obs-InfraObs
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 17h
Merged PRs (30d)
225

Description

### Integration Name

AWS CloudTrail Logs OpenTelemetry Assets [aws_cloudtrail_otel]

### Dataset Name

default

### Integration Version

6.5.0

### Agent Version

N/A

### Agent Output Type

elasticsearch

### Elasticsearch Version

N/A

### OS Version and Architecture

N/A

### Software/API Version

_No response_

### Error Message

_No response_

### Event Original

```json
{
"eventVersion": "1.11",
"userIdentity": {
"type": "WebIdentityUser",
"principalId": "arn:aws:iam::012345678901:oidc-provider/oidc.eks.us-west-2.amazonaws.com/id/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:sts.amazonaws.com:system:serviceaccount:kube-namespace:kube-sa",
"userName": "system:serviceaccount:kube-namespace:kube-sa",
"identityProvider": "arn:aws:iam::012345678901:oidc-provider/oidc.eks.us-west-2.amazonaws.com/id/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
},
"eventTime": "2026-04-14T21:05:31Z",
"eventSource": "sts.amazonaws.com",
"eventName": "AssumeRoleWithWebIdentity",
"awsRegion": "us-west-2",
```

### What did you do?

Trigger the 'AssumeRoleWithWebIdentity' event

### What did you see?

The `userIdentity.identityProvider` field is missing

### What did you expect to see?

I expect to be able to match against the `userIdentity.identityProvider` field, instead it is dropped by the integration.

### Anything else?

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.