Aller au contenu

Logs Insights Examples#

CloudTrail#

looking for S3 Events#

SQL
1
2
3
4
5
6
filter eventSource="s3.amazonaws.com"
#| filter eventName like "PutBucketLifecycle"
| filter userIdentity.principalId like "pgosselin"
#| stats count(*) by eventSource, eventName, awsRegion
| limit 100
| fields eventName, resources.0.ARN