使用AWS re:Post即您表示您同意 AWS re:Post 使用条款

Simple browse/search into CloudTrail events

0

Hi, CloudTrail events are often very useful to find issues with IAM permissions and other things but it's impossible browse and search easily using console. I'm an old-style sysadmin and I'd like to look and "grep" into them as text files. I'd liek to search for all "errors" or "all IAM access denied". Is there some simple tool?

已提问 2 年前620 查看次数
3 回答
0

I find Athena the best way to query CloudTrail logs. See the AWS Docs for how to set this up from the CloudTrail console: https://docs.aws.amazon.com/athena/latest/ug/cloudtrail-logs.html#create-cloudtrail-table-ct

profile pictureAWS
已回答 2 年前
  • I will try but I'm more comfortable with CLI tools, like AWS CLI, jq, grep, etc

0

If you are also outputting CloudTrail logs to cloudwatch logs, you can use log insights to search in a similar way to grep.

fields @timestamp, @message, @logStream, @log
| filter @message like /AccessDenied/
| sort @timestamp desc
| limit 20
profile picture
专家
已回答 2 年前
0

Search only errors and output only chosen fields:

aws cloudtrail lookup-events --output text --region eu-central-1 --start-time 2023-03-21T09:00Z --end-time 2023-03-21T10:00Z --query 'Events[].CloudTrailEvent' | jq -r ' . | select(.errorCode != null) | [.eventTime,.eventID,.eventName,.errorCode,.errorMessage] | @csv'

in a fixed time interval.

已回答 2 年前

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则