Querying Amazon CloudTrail

0

I never queried CloudTrail. I wanted to see if anyone has modified specific DB instance in the past months or past year(s). How do I retrieve the details?

已提問 10 個月前檢視次數 325 次
1 個回答
2
已接受的答案

Cloudtrail keeps history of API calls for past 90 days only, if you haven't setup cloudtrail to save store the cloudtrail data in S3 bucket, it's not possible to view past year activity not only related with DB but applies for everything.

Refer Monitoring Amazon RDS API calls in AWS CloudTrail

For past month or within 90 days of data, you can view the events either though Cloudtrail console or through Athena Table:

  1. Go to Cloudtrail Console
  2. Select "EventName" in "Lookup Attributes"
  3. Enter "ModifyDBInstance" in ""Eventname** <-- This would show you the data that you are looking for ModifyDBInstance, if you want to create Athena table for all the API calls of last 90 days, remove all filters and then follow step-4. You can directly download this data from console.
  4. On the upper right, you'd see the option of creating Athena Table
  5. Once you create the Athen Table, you can query like SQL in Athena table for any event

Athena Query would look like as below, you can add additional filters to it depending on your requirement. If you haven't already created Athena Table, then Once you create Athena Table(Step-4), you'll get the table_name, which you'd query:

        select * from <table_name> where "eventname"='ModifyDBInstance' and DATE_PARSE(eventtime, '%Y-%m-%d') <= DATE_PARSE('2023-07-02', '%Y-%m-%d')

Note: This query result would be saved to S3 bucket, which you'd have configured in Athena workgroup, you can download that result.

profile pictureAWS
專家
已回答 10 個月前
profile picture
專家
已審閱 10 個月前
profile picture
專家
已審閱 10 個月前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南