Simple browse/search into CloudTrail events

Question

Hi,
CloudTrail events are often very useful to find issues with IAM permissions and other things but it's impossible browse and search easily using console.
I'm an old-style sysadmin and I'd like to look and "grep" into them as text files.
I'd liek to search for all "errors" or "all IAM access denied".
Is there some simple tool?

Answer

I find Athena the best way to query CloudTrail logs. See the AWS Docs for how to set this up from the CloudTrail console: https://docs.aws.amazon.com/athena/latest/ug/cloudtrail-logs.html#create-cloudtrail-table-ct

Answer

If you are also outputting CloudTrail logs to cloudwatch logs, you can use log insights to search in a similar way to grep.

```
fields @timestamp, @message, @logStream, @log
| filter @message like /AccessDenied/
| sort @timestamp desc
| limit 20
```

Answer

Search only errors and output only chosen fields:
```
aws cloudtrail lookup-events --output text --region eu-central-1 --start-time 2023-03-21T09:00Z --end-time 2023-03-21T10:00Z --query 'Events[].CloudTrailEvent' | jq -r ' . | select(.errorCode != null) | [.eventTime,.eventID,.eventName,.errorCode,.errorMessage] | @csv'
```
in a fixed time interval.

Simple browse/search into CloudTrail events

Relevant content