elastic / elastic/integrations
[AWS-CloudTrail]: Missing 'userIdentity.identityProvider' field from AssumeRoleWithWebIdentity events
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 225
Description
### Integration Name
AWS CloudTrail Logs OpenTelemetry Assets [aws_cloudtrail_otel]
### Dataset Name
default
### Integration Version
6.5.0
### Agent Version
N/A
### Agent Output Type
elasticsearch
### Elasticsearch Version
N/A
### OS Version and Architecture
N/A
### Software/API Version
_No response_
### Error Message
_No response_
### Event Original
```json
{
"eventVersion": "1.11",
"userIdentity": {
"type": "WebIdentityUser",
"principalId": "arn:aws:iam::012345678901:oidc-provider/oidc.eks.us-west-2.amazonaws.com/id/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA:sts.amazonaws.com:system:serviceaccount:kube-namespace:kube-sa",
"userName": "system:serviceaccount:kube-namespace:kube-sa",
"identityProvider": "arn:aws:iam::012345678901:oidc-provider/oidc.eks.us-west-2.amazonaws.com/id/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
},
"eventTime": "2026-04-14T21:05:31Z",
"eventSource": "sts.amazonaws.com",
"eventName": "AssumeRoleWithWebIdentity",
"awsRegion": "us-west-2",
```
### What did you do?
Trigger the 'AssumeRoleWithWebIdentity' event
### What did you see?
The `userIdentity.identityProvider` field is missing
### What did you expect to see?
I expect to be able to match against the `userIdentity.identityProvider` field, instead it is dropped by the integration.
### Anything else?
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.