Data of shut down instances from the past 90 days

0

We need help to get the data of shut down instances in all regions from the past 90 days on all member accounts from Management (root) account using Athena.

We have a sample script but the script failed. Sample script: SELECT eventTime, requestParameters.instancesSet.items.instanceId FROM cloudtrail_logs.ec2_instance_state_change WHERE eventName IN ('StopInstances', 'TerminateInstances') AND eventTime >= date_sub('day', 90, current_date) ORDER BY eventTime DESC;

Error: SCHEMA_NOT_FOUND: line 2:6: Schema 'cloudtrail_logs' does not exist This query ran against the "athenacurcfn_c_u_r_hourly" database, unless qualified by the query. Please post the error message on our forum or contact customer support with Query Id: 7b4b1708-b0fd-4671-abd5-6c506ad934de

已提问 2 个月前61 查看次数
1 回答
0

Are you sure the organizational CloudTrail is in your management account? this is usually not the case.

If you used Control Tower to create your Landing Zone, the organizational CloudTrail is by default in an account called Log Archive under the Security organizational unit (OU).

profile pictureAWS
专家
已回答 2 个月前

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则