name: AWS CloudTrail ModifyImageAttribute
id: 667c2115-8082-419e-b541-8150066bda4d
version: 3
creation_date: '2024-05-22'
modification_date: '2026-05-13'
author: Patrick Bareiss, Splunk
description: Logs an event when the attributes of an Amazon Machine Image (AMI) are modified.
mitre_components:
    - Image Modification
    - Image Metadata
source: aws_cloudtrail
sourcetype: aws:cloudtrail
separator: eventName
separator_value: ModifyImageAttribute
supported_TA:
    - name: Splunk Add-on for AWS
      url: https://splunkbase.splunk.com/app/1876
      version: 8.1.2
fields:
    - _time
    - app
    - awsRegion
    - aws_account_id
    - change_type
    - command
    - date_hour
    - date_mday
    - date_minute
    - date_month
    - date_second
    - date_wday
    - date_year
    - date_zone
    - dest
    - dvc
    - errorCode
    - eventCategory
    - eventID
    - eventName
    - eventSource
    - eventTime
    - eventType
    - eventVersion
    - host
    - index
    - linecount
    - managementEvent
    - msg
    - object_category
    - product
    - punct
    - readOnly
    - recipientAccountId
    - region
    - requestID
    - requestParameters.attributeType
    - requestParameters.imageId
    - requestParameters.launchPermission.add.items{}.userId
    - responseElements._return
    - responseElements.requestId
    - sessionCredentialFromConsole
    - signature
    - source
    - sourceIPAddress
    - sourcetype
    - splunk_server
    - src
    - src_ip
    - start_time
    - timeendpos
    - timestartpos
    - user
    - userAgent
    - userIdentity.accessKeyId
    - userIdentity.accountId
    - userIdentity.arn
    - userIdentity.principalId
    - userIdentity.sessionContext.attributes.creationDate
    - userIdentity.sessionContext.attributes.mfaAuthenticated
    - userIdentity.sessionContext.sessionIssuer.accountId
    - userIdentity.sessionContext.sessionIssuer.arn
    - userIdentity.sessionContext.sessionIssuer.principalId
    - userIdentity.sessionContext.sessionIssuer.type
    - userIdentity.sessionContext.sessionIssuer.userName
    - userIdentity.type
    - userName
    - user_access_key
    - user_agent
    - user_arn
    - user_group_id
    - user_id
    - user_name
    - user_type
    - vendor
    - vendor_account
    - vendor_product
    - vendor_region
output_fields:
    - dest
    - user
    - user_agent
    - src
    - vendor_account
    - vendor_region
    - vendor_product
example_log: '{"eventVersion": "1.08", "userIdentity": {"type": "AssumedRole", "principalId": "AROAYTOGP2RLDF6WP4HD6:bonobo@bo.com", "arn": "arn:aws:sts::111111111111:assumed-role/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f/bonobo@bo.com", "accountId": "111111111111", "accessKeyId": "ASIAYTOGP2RLBHIEEEPN", "sessionContext": {"sessionIssuer": {"type": "Role", "principalId": "AROAYTOGP2RLDF6WP4HD6", "arn": "arn:aws:iam::111111111111:role/aws-reserved/sso.amazonaws.com/us-west-2/AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f", "accountId": "111111111111", "userName": "AWSReservedSSO_SPLKAdministratorAccess_d9ce1347d0a6dd3f"}, "webIdFederationData": {}, "attributes": {"creationDate": "2023-03-23T19:27:44Z", "mfaAuthenticated": "false"}}}, "eventTime": "2023-03-23T21:47:28Z", "eventSource": "ec2.amazonaws.com", "eventName": "ModifyImageAttribute", "awsRegion": "us-west-2", "sourceIPAddress": "72.135.245.10", "userAgent": "AWS Internal", "requestParameters": {"imageId": "ami-06dac31db29508566", "launchPermission": {"add": {"items": [{"userId": "1111111111111111"}]}}, "attributeType": "launchPermission"}, "responseElements": {"requestId": "84c431ce-6268-4218-aaf8-b4cdc1cd4055", "_return": true}, "requestID": "84c431ce-6268-4218-aaf8-b4cdc1cd4055", "eventID": "957e1b12-ea17-4006-aefd-20677ace72b8", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111111111111", "eventCategory": "Management", "sessionCredentialFromConsole": "true"}'