Data of shut down instances from the past 90 days

Question

We need help to get the data of shut down instances in all regions from the past 90 days on all member accounts from Management (root) account using Athena.

We have a sample script but the script failed.
Sample script: 
SELECT eventTime, requestParameters.instancesSet.items.instanceId 
FROM cloudtrail_logs.ec2_instance_state_change
WHERE eventName IN ('StopInstances', 'TerminateInstances')
  AND eventTime >= date_sub('day', 90, current_date)
ORDER BY eventTime DESC;

Error:
SCHEMA_NOT_FOUND: line 2:6: Schema 'cloudtrail_logs' does not exist
This query ran against the "athenacurcfn_c_u_r_hourly" database, unless qualified by the query. Please post the error message on our forum  or contact customer support  with Query Id: 7b4b1708-b0fd-4671-abd5-6c506ad934de

Yaniv Rozenboim · Answer

Are you sure the organizational CloudTrail is in your management account? this is usually not the case.

If you used Control Tower to create your Landing Zone, the organizational CloudTrail is by default in an account called **Log Archive** under the **Security** organizational unit (OU).

Data of shut down instances from the past 90 days

Relevant content