【AWS CLI 示例集】CloudTrail

我们主要检查是否可以使用AWS Cloud9执行命令。
如果您想提供示例命令，请使用下面的表格提交。
如果列出的命令示例有任何错误，请在此处更正。

---

列出过去 90 天内尝试启动 EC2 的时间和用户

aws cloudtrail lookup-events \
--lookup-attributes AttributeKey=EventName,AttributeValue=RunInstances \
--query 'Events[*].[EventTime, Username] | map(&[], @)' \
--output text

输出

2024-05-10T07:00:19+09:00     i-5203422c
2024-05-10T07:00:19+09:00     AutoScaling
2024-05-09T07:00:16+09:00     UserA
2024-05-09T07:00:13+09:00     UserB
2024-05-08T07:00:16+09:00     UserC
2024-05-08T07:00:13+09:00     UserD
＜以下省略＞

by anonymous

列出过去 90 天内 EC2 启动失败的时间和用户

aws cloudtrail lookup-events \
--lookup-attributes AttributeKey=EventName,AttributeValue=RunInstances \
--query 'Events[?contains(CloudTrailEvent,`errorMessage`)].[EventTime, Username] | map(&[], @)' \
--output text

输出

2024-05-10T07:00:19+09:00     i-5203422c
2024-05-08T07:00:16+09:00     UserC
2024-05-08T07:00:13+09:00     UserD
＜以下省略＞

by anonymous

列出过去 90 天内启动 EC2 的时间、实例 ID 和用户

aws cloudtrail lookup-events \
--lookup-attributes AttributeKey=EventName,AttributeValue=RunInstances \
--query 'Events[?!contains(CloudTrailEvent,`errorMessage`)].[EventTime, Resources[?ResourceType==`AWS::EC2::Instance`].ResourceName[], Username] | map(&[], @)' \
--output text

输出

2024-05-10T07:00:19+09:00     i-5203422c       AutoScaling
2024-05-09T07:00:16+09:00     i-5203422d       UserA
2024-05-09T07:00:13+09:00     i-5203422e       UserB
＜以下省略＞

by anonymous

列出过去 3 天内与特定战利品表交互的时间、操作和用户

start=$(date --date '3 days ago' '+%s')
aws cloudtrail lookup-events \
--lookup-attributes AttributeKey=ResourceType,AttributeValue=AWS::EC2::RouteTable \
--start-time $start \
--query 'Events[?Resources[0].ResourceName==`rtb-01234567890123456`].[EventTime, EventName, Username]' \
--output text

输出

2024-05-18T13:26:30+00:00       DeleteRoute     UserA
2024-05-18T13:25:42+00:00       CreateRoute     UserB
2024-05-18T13:05:00+00:00       AssociateRouteTable     UserA
2024-05-18T12:30:28+00:00       DeleteRoute     UserB
＜以下省略＞

by anonymous