Al usar AWS re:Post, aceptas las AWS re:Post Términos de uso

Simple browse/search into CloudTrail events

0

Hi, CloudTrail events are often very useful to find issues with IAM permissions and other things but it's impossible browse and search easily using console. I'm an old-style sysadmin and I'd like to look and "grep" into them as text files. I'd liek to search for all "errors" or "all IAM access denied". Is there some simple tool?

preguntada hace 2 años618 visualizaciones
3 Respuestas
0

I find Athena the best way to query CloudTrail logs. See the AWS Docs for how to set this up from the CloudTrail console: https://docs.aws.amazon.com/athena/latest/ug/cloudtrail-logs.html#create-cloudtrail-table-ct

profile pictureAWS
respondido hace 2 años
  • I will try but I'm more comfortable with CLI tools, like AWS CLI, jq, grep, etc

0

If you are also outputting CloudTrail logs to cloudwatch logs, you can use log insights to search in a similar way to grep.

fields @timestamp, @message, @logStream, @log
| filter @message like /AccessDenied/
| sort @timestamp desc
| limit 20
profile picture
EXPERTO
respondido hace 2 años
0

Search only errors and output only chosen fields:

aws cloudtrail lookup-events --output text --region eu-central-1 --start-time 2023-03-21T09:00Z --end-time 2023-03-21T10:00Z --query 'Events[].CloudTrailEvent' | jq -r ' . | select(.errorCode != null) | [.eventTime,.eventID,.eventName,.errorCode,.errorMessage] | @csv'

in a fixed time interval.

respondido hace 2 años

No has iniciado sesión. Iniciar sesión para publicar una respuesta.

Una buena respuesta responde claramente a la pregunta, proporciona comentarios constructivos y fomenta el crecimiento profesional en la persona que hace la pregunta.

Pautas para responder preguntas