[bshacklett]

assuming you can get the cloud trail message sometimes there’s more information that you can decode using the STS service:

https://docs.aws.amazon.com/cli/latest/reference/sts/decode-...