Data of shut down instances from the past 90 days

0

We need help to get the data of shut down instances in all regions from the past 90 days on all member accounts from Management (root) account using Athena.

We have a sample script but the script failed. Sample script: SELECT eventTime, requestParameters.instancesSet.items.instanceId FROM cloudtrail_logs.ec2_instance_state_change WHERE eventName IN ('StopInstances', 'TerminateInstances') AND eventTime >= date_sub('day', 90, current_date) ORDER BY eventTime DESC;

Error: SCHEMA_NOT_FOUND: line 2:6: Schema 'cloudtrail_logs' does not exist This query ran against the "athenacurcfn_c_u_r_hourly" database, unless qualified by the query. Please post the error message on our forum or contact customer support with Query Id: 7b4b1708-b0fd-4671-abd5-6c506ad934de

質問済み 2ヶ月前62ビュー
1回答
0

Are you sure the organizational CloudTrail is in your management account? this is usually not the case.

If you used Control Tower to create your Landing Zone, the organizational CloudTrail is by default in an account called Log Archive under the Security organizational unit (OU).

profile pictureAWS
エキスパート
回答済み 2ヶ月前

ログインしていません。 ログイン 回答を投稿する。

優れた回答とは、質問に明確に答え、建設的なフィードバックを提供し、質問者の専門分野におけるスキルの向上を促すものです。

質問に答えるためのガイドライン

関連するコンテンツ