Querying Amazon CloudTrail

0

I never queried CloudTrail. I wanted to see if anyone has modified specific DB instance in the past months or past year(s). How do I retrieve the details?

已提问 10 个月前324 查看次数
1 回答
2
已接受的回答

Cloudtrail keeps history of API calls for past 90 days only, if you haven't setup cloudtrail to save store the cloudtrail data in S3 bucket, it's not possible to view past year activity not only related with DB but applies for everything.

Refer Monitoring Amazon RDS API calls in AWS CloudTrail

For past month or within 90 days of data, you can view the events either though Cloudtrail console or through Athena Table:

  1. Go to Cloudtrail Console
  2. Select "EventName" in "Lookup Attributes"
  3. Enter "ModifyDBInstance" in ""Eventname** <-- This would show you the data that you are looking for ModifyDBInstance, if you want to create Athena table for all the API calls of last 90 days, remove all filters and then follow step-4. You can directly download this data from console.
  4. On the upper right, you'd see the option of creating Athena Table
  5. Once you create the Athen Table, you can query like SQL in Athena table for any event

Athena Query would look like as below, you can add additional filters to it depending on your requirement. If you haven't already created Athena Table, then Once you create Athena Table(Step-4), you'll get the table_name, which you'd query:

        select * from <table_name> where "eventname"='ModifyDBInstance' and DATE_PARSE(eventtime, '%Y-%m-%d') <= DATE_PARSE('2023-07-02', '%Y-%m-%d')

Note: This query result would be saved to S3 bucket, which you'd have configured in Athena workgroup, you can download that result.

profile pictureAWS
专家
已回答 10 个月前
profile picture
专家
已审核 10 个月前
profile picture
专家
已审核 10 个月前

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则