Logs Insights Examples# CloudTrail# looking for S3 Events# SQL1 2 3 4 5 6filter eventSource="s3.amazonaws.com" #| filter eventName like "PutBucketLifecycle" | filter userIdentity.principalId like "pgosselin" #| stats count(*) by eventSource, eventName, awsRegion | limit 100 | fields eventName, resources.0.ARN