Querying Amazon CloudTrail

0

I never queried CloudTrail. I wanted to see if anyone has modified specific DB instance in the past months or past year(s). How do I retrieve the details?

asked 10 months ago307 views
1 Answer
2
Accepted Answer

Cloudtrail keeps history of API calls for past 90 days only, if you haven't setup cloudtrail to save store the cloudtrail data in S3 bucket, it's not possible to view past year activity not only related with DB but applies for everything.

Refer Monitoring Amazon RDS API calls in AWS CloudTrail

For past month or within 90 days of data, you can view the events either though Cloudtrail console or through Athena Table:

  1. Go to Cloudtrail Console
  2. Select "EventName" in "Lookup Attributes"
  3. Enter "ModifyDBInstance" in ""Eventname** <-- This would show you the data that you are looking for ModifyDBInstance, if you want to create Athena table for all the API calls of last 90 days, remove all filters and then follow step-4. You can directly download this data from console.
  4. On the upper right, you'd see the option of creating Athena Table
  5. Once you create the Athen Table, you can query like SQL in Athena table for any event

Athena Query would look like as below, you can add additional filters to it depending on your requirement. If you haven't already created Athena Table, then Once you create Athena Table(Step-4), you'll get the table_name, which you'd query:

        select * from <table_name> where "eventname"='ModifyDBInstance' and DATE_PARSE(eventtime, '%Y-%m-%d') <= DATE_PARSE('2023-07-02', '%Y-%m-%d')

Note: This query result would be saved to S3 bucket, which you'd have configured in Athena workgroup, you can download that result.

profile pictureAWS
EXPERT
answered 10 months ago
profile picture
EXPERT
reviewed 10 months ago
profile picture
EXPERT
reviewed 10 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions