I believe it's due the userIdentity.type which is unknown
{
"eventVersion": "1.09",
"userIdentity": {
"type": "Unknown",
"principal": "<odd string>"
},
"userAgent": "Coral/Netty4",
"_": "..."
}
This particular event comes up a lot. I wonder if it's better to ignore iot:RegisterCertificate.
I see that the useragent does match for it but it doesn't appear to be clickops to me.
|
self.USER_AGENTS = {"console.amazonaws.com", "Coral/Jakarta", "Coral/Netty4"} |