Querying Amazon CloudTrail

0

I never queried CloudTrail. I wanted to see if anyone has modified specific DB instance in the past months or past year(s). How do I retrieve the details?

질문됨 10달 전326회 조회
1개 답변
2
수락된 답변

Cloudtrail keeps history of API calls for past 90 days only, if you haven't setup cloudtrail to save store the cloudtrail data in S3 bucket, it's not possible to view past year activity not only related with DB but applies for everything.

Refer Monitoring Amazon RDS API calls in AWS CloudTrail

For past month or within 90 days of data, you can view the events either though Cloudtrail console or through Athena Table:

  1. Go to Cloudtrail Console
  2. Select "EventName" in "Lookup Attributes"
  3. Enter "ModifyDBInstance" in ""Eventname** <-- This would show you the data that you are looking for ModifyDBInstance, if you want to create Athena table for all the API calls of last 90 days, remove all filters and then follow step-4. You can directly download this data from console.
  4. On the upper right, you'd see the option of creating Athena Table
  5. Once you create the Athen Table, you can query like SQL in Athena table for any event

Athena Query would look like as below, you can add additional filters to it depending on your requirement. If you haven't already created Athena Table, then Once you create Athena Table(Step-4), you'll get the table_name, which you'd query:

        select * from <table_name> where "eventname"='ModifyDBInstance' and DATE_PARSE(eventtime, '%Y-%m-%d') <= DATE_PARSE('2023-07-02', '%Y-%m-%d')

Note: This query result would be saved to S3 bucket, which you'd have configured in Athena workgroup, you can download that result.

profile pictureAWS
전문가
답변함 10달 전
profile picture
전문가
검토됨 10달 전
profile picture
전문가
검토됨 10달 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠