Three fields answer most questions: eventName (what was done), userIdentity (who did it), and errorCode (whether it failed, and how). Record format version 1.11 is current. Minor versions only add fields; a new major version would break parsers.

Record fields

Field	Meaning
`eventTime`	When the request completed (UTC), as recorded by the API host
`eventSource`	The service, as `<service>.amazonaws.com`. Watch for exceptions: CloudWatch is `monitoring.amazonaws.com`
`eventName`	The API action, for example `DeleteBucket`
`awsRegion`	The Region the request was sent to
`sourceIPAddress`	The caller's IP. For console actions, it is the IP of the user's own resource, not the console server. Calls from services inside AWS show a DNS name, and AWS-originated events usually show `AWS Internal/#`
`userAgent`	The client (console, SDK, CLI or service), up to 1 KB
`errorCode`	Present only on failure: the service's error code (up to 1 KB). VPC endpoint policy denials show `VpceAccessDenied`. Some services report errors inside `responseElements` instead
`errorMessage`	The failure description, including authorization failure messages (up to 1 KB). VPC endpoint denials always say "The request was denied due to a VPC endpoint policy."
`requestParameters`	What the caller sent. Omitted over 100 KB
`responseElements`	What create, update and delete calls returned. `null` for read-only calls and for calls that return nothing; omitted over 100 KB
`additionalEventData`	Extra data, for example `MFAUsed` on console sign-in
`requestID` / `eventID`	The service's request ID (for AWS Support) / CloudTrail's unique event ID
`eventType`	`AwsApiCall`, `AwsServiceEvent`, `AwsConsoleAction`, `AwsConsoleSignIn` or `AwsVpceEvents`
`readOnly`	`true` for reads such as `Describe*`, `false` for writes
`eventCategory` / `managementEvent`	`Management`, `Data` or `NetworkActivity` / a boolean (version 1.06 and later)
`recipientAccountId`	The account that received the call. It differs from `userIdentity.accountId` on cross-account access
`sharedEventID`	The same GUID on the copies of one cross-account action delivered to each account. Absent when caller and owner are the same account
`vpcEndpointId`	The interface endpoint the call came through
`tlsDetails`	TLS version, cipher suite and `clientProvidedHostHeader`. Absent for calls AWS services make for you
`sessionCredentialFromConsole`	Present (`true`) when console session credentials were used through a proxy or external client

`userIdentity.type`

The type names come from the userIdentity reference. The short descriptions of Role, FederatedUser, AWSAccount, AWSService and Directory are the hub's reading of those names.

Type	Who
`Root`	The account root user
`IAMUser`	An IAM user's long-term keys or console password
`AssumedRole`	Temporary credentials from `AssumeRole*`: the most common type for workloads, CI and SSO
`Role`	A role identity in some service-made events
`FederatedUser`	`GetFederationToken` credentials
`IdentityCenterUser`	An IAM Identity Center user (with `onBehalfOf.userId` and `identityStoreArn`)
`AWSAccount` / `AWSService`	Another account / an AWS service principal
`Directory`, `BuilderIdUser`, `Unknown`	Directory service users, AWS Builder ID, unidentified
`SAMLUser` / `WebIdentityUser`	Appear on `AssumeRoleWithSAML` / `AssumeRoleWithWebIdentity` events themselves

Fields that identify a session

arn: for AssumedRole, arn:aws:sts::<account>:assumed-role/<RoleName>/<SessionName>.
principalId: <role-id>:<SessionName> (the role ID starts AROA).
accessKeyId: the temporary key that signed the call. It can be empty. All calls made with one session share it.
sessionContext.sessionIssuer: type, arn, principalId, accountId and userName of the role that issued the session. This is where the role name lives for AssumedRole.
sessionContext.attributes: creationDate (when the credentials were issued) and mfaAuthenticated.
sessionContext.sourceIdentity: the original identity, carried through role chains, but only if administrators have configured STS to require a source identity.
sessionContext.signInSessionArn: a console sign-in session, which can be audited or revoked.
sessionContext.webIdFederationData: the identity provider details for web-identity sessions, such as GitHub OIDC.
invokedBy: the AWS service that made the request for you. It appears with service roles, service-linked roles and forward access sessions.
inScopeOf: on service-to-service calls, sourceArn, sourceAccount, issuerType and credentialsIssuedTo.
credentialId: set when a bearer token, such as an Identity Center access token, was used.

Following a chain

Example: GitHub OIDC → CI role → CDK deploy role → CloudFormation execution role.

The resource's event (for example CreateFunction) shows the role that made the call in sessionContext.sessionIssuer.arn. For a CloudFormation stack with a service role, that is the execution role, and invokedBy names the service. CloudFormation's session name for that role isn't documented on the fetched pages.
Search for the AssumeRole event that issued that session: same role and session name, around creationDate. Matching on the access key in its responseElements is the hub's method; the page suggests matching on accessKeyId, creationDate and sessionIssuer. Its userIdentity is the next link up, for example the CDK deploy role or your CI role.
Repeat until you reach an AssumeRoleWithWebIdentity event (CI: webIdFederationData names the provider) or an Identity Center or IAM user.

Configuring sourceIdentity saves this walk: every downstream event carries the original identity.