Skip to content
AWS for Query.Farm

aws.cloudtrail.get_trail_status

Example SQL Queries

SELECT * FROM
aws.cloudtrail.get_trail_status
WHERE
"name" = 'VALUE';

Description

Returns a JSON-formatted list of information about the specified trail. Fields include information on delivery errors, Amazon SNS and Amazon S3 errors, and start and stop logging times for each trail. This operation returns trail status from a single Region. To return trail status from all Regions, you must call the operation on each Region.

Table Definition

Column NameColumn Data Type
name Required Input Column

Specifies the name or the CloudTrail ARN of the trail for which you are requesting status. To get the status of a shadow trail (a replication of the trail in another Region), you must specify its ARN. The following is the format of a trail ARN.

arn:aws:cloudtrail:us-east-2:123456789012:trail/MyTrail 

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
is_logging

Whether the CloudTrail trail is currently logging Amazon Web Services API calls.

BOOLEAN
latest_cloud_watch_logs_delivery_error

Displays any CloudWatch Logs error that CloudTrail encountered when attempting to deliver logs to CloudWatch Logs.

VARCHAR
latest_cloud_watch_logs_delivery_time

Displays the most recent date and time when CloudTrail delivered logs to CloudWatch Logs.

TIMESTAMP_S
latest_delivery_attempt_succeeded

This field is no longer in use.

VARCHAR
latest_delivery_attempt_time

This field is no longer in use.

VARCHAR
latest_delivery_error

Displays any Amazon S3 error that CloudTrail encountered when attempting to deliver log files to the designated bucket. For more information, see Error Responses in the Amazon S3 API Reference.

This error occurs only when there is a problem with the destination S3 bucket, and does not occur for requests that time out. To resolve the issue, fix the bucket policy so that CloudTrail can write to the bucket; or create a new bucket and call UpdateTrail to specify the new bucket.

VARCHAR
latest_delivery_time

Specifies the date and time that CloudTrail last delivered log files to an account's Amazon S3 bucket.

TIMESTAMP_S
latest_digest_delivery_error

Displays any Amazon S3 error that CloudTrail encountered when attempting to deliver a digest file to the designated bucket. For more information, see Error Responses in the Amazon S3 API Reference.

This error occurs only when there is a problem with the destination S3 bucket, and does not occur for requests that time out. To resolve the issue, fix the bucket policy so that CloudTrail can write to the bucket; or create a new bucket and call UpdateTrail to specify the new bucket.

VARCHAR
latest_digest_delivery_time

Specifies the date and time that CloudTrail last delivered a digest file to an account's Amazon S3 bucket.

TIMESTAMP_S
latest_notification_attempt_succeeded

This field is no longer in use.

VARCHAR
latest_notification_attempt_time

This field is no longer in use.

VARCHAR
latest_notification_error

Displays any Amazon SNS error that CloudTrail encountered when attempting to send a notification. For more information about Amazon SNS errors, see the Amazon SNS Developer Guide. 

VARCHAR
latest_notification_time

Specifies the date and time of the most recent Amazon SNS notification that CloudTrail has written a new log file to an account's Amazon S3 bucket.

TIMESTAMP_S
start_logging_time

Specifies the most recent date and time when CloudTrail started recording API calls for an Amazon Web Services account.

TIMESTAMP_S
stop_logging_time

Specifies the most recent date and time when CloudTrail stopped recording API calls for an Amazon Web Services account.

TIMESTAMP_S
time_logging_started

This field is no longer in use.

VARCHAR
time_logging_stopped

This field is no longer in use.

VARCHAR