Currently CloudSOC can only report the CloudService Username as "user".
The Amazon CloudDrive Gatelet is generic and only supports upload and download. There is a known limition for how the CloudDrive user is discovered.
Investigate activity does not report on login.
Upload and download will report the CloudService Username as "user".