Locate Source IP and User Agent in CloudTrail Logs

Quick Answer

Every CloudTrail event record is a structured JSON object with a consistent set of fields regardless of which service or API call generated it, and two of those fields exist specifically to answer the who-and-how question during an investigation: sourceIPAddress records the IP address the request actually came from, and userAgent records what tool or client made the call, such as the AWS CLI, an SDK, or a browser session in the console. Because these fields are present on essentially every CloudTrail event, they are the standard starting point whenever an investigation needs to establish where a suspicious or destructive API call originated and what client software issued it, which is exactly the information needed here to trace the DeleteBucket call back to its source. This is worth generalizing beyond this one question: CloudTrail event records also include fields like eventTime, eventName, and userIdentity that capture different dimensions of an API call, so investigators need to know which field maps to which piece of information rather than treating the whole record as one undifferentiated blob. Whenever an AWS security scenario asks specifically for the origin or client of an API call rather than who made it or when it happened, the answer points to sourceIPAddress and userAgent, and recognizing that CloudTrail records are field-structured rather than free text is the fastest way to answer these log-analysis questions correctly.