Skip to content
AWS for Query.Farm

aws.cloudtrail.get_trail

Example SQL Queries

SELECT * FROM
aws.cloudtrail.get_trail
WHERE
"name" = 'VALUE';

Description

Returns settings information for a specified trail.

Table Definition

Column NameColumn Data Type
name Required Input Column

The name or the Amazon Resource Name (ARN) of the trail for which you want to retrieve settings information.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
trail

The settings for a trail.

STRUCT(
    "name" VARCHAR,
    "s3_bucket_name" VARCHAR,
    "s3_key_prefix" VARCHAR,
    "sns_topic_name" VARCHAR,
    "sns_topic_arn" VARCHAR,
    "include_global_service_events" BOOLEAN,
    "is_multi_region_trail" BOOLEAN,
    "home_region" VARCHAR,
    "trail_arn" VARCHAR,
    "log_file_validation_enabled" BOOLEAN,
    "cloud_watch_logs_log_group_arn" VARCHAR,
    "cloud_watch_logs_role_arn" VARCHAR,
    "kms_key_id" VARCHAR,
    "has_custom_event_selectors" BOOLEAN,
    "has_insight_selectors" BOOLEAN,
    "is_organization_trail" BOOLEAN
)
Show child fields
trail.cloud_watch_logs_log_group_arn

Specifies an Amazon Resource Name (ARN), a unique identifier that represents the log group to which CloudTrail logs will be delivered.

trail.cloud_watch_logs_role_arn

Specifies the role for the CloudWatch Logs endpoint to assume to write to a user's log group.

trail.has_custom_event_selectors

Specifies if the trail has custom event selectors.

trail.has_insight_selectors

Specifies whether a trail has insight types specified in an InsightSelector list.

trail.home_region

The Region in which the trail was created.

trail.include_global_service_events

Set to True to include Amazon Web Services API calls from Amazon Web Services global services such as IAM. Otherwise, False.

trail.is_multi_region_trail

Specifies whether the trail exists only in one Region or exists in all Regions.

trail.is_organization_trail

Specifies whether the trail is an organization trail.

trail.kms_key_id

Specifies the KMS key ID that encrypts the logs delivered by CloudTrail. The value is a fully specified ARN to a KMS key in the following format.

arn:aws:kms:us-east-2:123456789012:key/12345678-1234-1234-1234-123456789012

trail.log_file_validation_enabled

Specifies whether log file validation is enabled.

trail.name

Name of the trail set by calling CreateTrail. The maximum length is 128 characters.

trail.s3_bucket_name

Name of the Amazon S3 bucket into which CloudTrail delivers your trail files. See Amazon S3 Bucket naming rules.

trail.s3_key_prefix

Specifies the Amazon S3 key prefix that comes after the name of the bucket you have designated for log file delivery. For more information, see Finding Your CloudTrail Log Files. The maximum length is 200 characters.

trail.sns_topic_arn

Specifies the ARN of the Amazon SNS topic that CloudTrail uses to send notifications when log files are delivered. The following is the format of a topic ARN.

arn:aws:sns:us-east-2:123456789012:MyTopic

trail.sns_topic_name

This field is no longer in use. Use SnsTopicARN.

trail.trail_arn

Specifies the ARN of the trail. The following is the format of a trail ARN.

arn:aws:cloudtrail:us-east-2:123456789012:trail/MyTrail