{"id":"cloudtrail-assume-role-readonly-true","text":"AssumeRole, AssumeRoleWithSAML, and AssumeRoleWithWebIdentity are logged as `readOnly: true` in CloudTrail despite generating credentials; GetSessionToken and GetFederationToken are `readOnly: false`.","truth_value":"IN","source":"entries/2026/03/11/IAM-latest-UserGuide-cloudtrail-integrationhtml.md","source_url":"","source_hash":"cb7bc3bfff11f21a","justifications":[],"dependents":[],"metadata":{},"explanation":{"steps":[{"node":"cloudtrail-assume-role-readonly-true","truth_value":"IN","reason":"premise"}]}}