Config

{
    "@timestamp": "2025-05-22T05:50:38.505Z",
    "agent": {
        "ephemeral_id": "0624c520-ec3a-4e52-90e4-188181f07c6c",
        "id": "9764cf02-72f4-48ac-af06-79c94b0e056b",
        "name": "elastic-agent-35398",
        "type": "filebeat",
        "version": "8.18.0"
    },
    "aws": {
        "config": {
            "compliance_type": "COMPLIANT",
            "config_rule_invoked_time": "2015-10-14T05:11:19.852Z",
            "evaluation_result_identifier": {
                "evaluation_result_qualifier": {
                    "config_rule_name": "access-keys-rotated",
                    "evaluation_mode": "DETECTIVE",
                    "resource_id": "i-0a4468fbfafeeg20h",
                    "resource_type": "AWS::EC2::Instance"
                },
                "ordering_timestamp": "2015-09-29T15:52:31.883Z"
            },
            "result_recorded_time": "2015-10-14T05:11:20.061Z",
            "rule_info": {
                "config_rule_arn": "arn:aws:config:us-east-1:11223344556:config-rule/config-rule-id1",
                "config_rule_id": "config-rule-id1",
                "config_rule_name": "access-keys-rotated",
                "config_rule_state": "ACTIVE",
                "description": "Checks whether the active access keys are rotated within the number of days specified in maxAccessKeyAge. The rule is non-compliant if the access keys have not been rotated for more than maxAccessKeyAge number of days.",
                "evaluation_modes": [
                    {
                        "mode": "DETECTIVE"
                    }
                ],
                "input_parameters": {
                    "maxAccessKeyAge": "90"
                },
                "maximum_execution_frequency": "TwentyFour_Hours",
                "source": {
                    "owner": "AWS",
                    "source_identifier": "ACCESS_KEYS_ROTATED"
                }
            }
        }
    },
    "cloud": {
        "account": {
            "id": "11223344556",
            "name": "11223344556"
        },
        "provider": "aws"
    },
    "data_stream": {
        "dataset": "aws.config",
        "namespace": "64685",
        "type": "logs"
    },
    "ecs": {
        "version": "8.17.0"
    },
    "elastic_agent": {
        "id": "9764cf02-72f4-48ac-af06-79c94b0e056b",
        "snapshot": false,
        "version": "8.18.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "configuration"
        ],
        "created": "2015-09-29T15:52:31.883Z",
        "dataset": "aws.config",
        "ingested": "2025-05-22T05:50:41Z",
        "kind": "event",
        "original": "{\"ComplianceType\":\"COMPLIANT\",\"ConfigRuleInfo\":{\"ConfigRuleArn\":\"arn:aws:config:us-east-1:11223344556:config-rule/config-rule-id1\",\"ConfigRuleId\":\"config-rule-id1\",\"ConfigRuleName\":\"access-keys-rotated\",\"ConfigRuleState\":\"ACTIVE\",\"Description\":\"Checks whether the active access keys are rotated within the number of days specified in maxAccessKeyAge. The rule is non-compliant if the access keys have not been rotated for more than maxAccessKeyAge number of days.\",\"EvaluationModes\":[{\"Mode\":\"DETECTIVE\"}],\"InputParameters\":\"{\\\"maxAccessKeyAge\\\":\\\"90\\\"}\",\"MaximumExecutionFrequency\":\"TwentyFour_Hours\",\"Source\":{\"Owner\":\"AWS\",\"SourceIdentifier\":\"ACCESS_KEYS_ROTATED\"}},\"ConfigRuleInvokedTime\":1444799479.852,\"EvaluationResultIdentifier\":{\"EvaluationResultQualifier\":{\"ConfigRuleName\":\"access-keys-rotated\",\"EvaluationMode\":\"DETECTIVE\",\"ResourceId\":\"i-0a4468fbfafeeg20h\",\"ResourceType\":\"AWS::EC2::Instance\"},\"OrderingTimestamp\":1443541951.883},\"ResultRecordedTime\":1444799480.061}",
        "outcome": "success",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "cel"
    },
    "message": "Checks whether the active access keys are rotated within the number of days specified in maxAccessKeyAge. The rule is non-compliant if the access keys have not been rotated for more than maxAccessKeyAge number of days.",
    "observer": {
        "vendor": "AWS Config"
    },
    "resource": {
        "id": "i-0a4468fbfafeeg20h",
        "type": "AWS::EC2::Instance"
    },
    "result": {
        "evaluation": "passed"
    },
    "rule": {
        "description": "Checks whether the active access keys are rotated within the number of days specified in maxAccessKeyAge. The rule is non-compliant if the access keys have not been rotated for more than maxAccessKeyAge number of days.",
        "id": "config-rule-id1",
        "name": "access-keys-rotated",
        "reference": "arn:aws:config:us-east-1:11223344556:config-rule/config-rule-id1"
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "aws-config"
    ]
}