Skip to content
AWS for Query.Farm

aws.cloudtrail.lookup_events

Example SQL Queries

SELECT * FROM
aws.cloudtrail.lookup_events;

Description

Looks up management events or CloudTrail Insights events that are captured by CloudTrail. You can look up events that occurred in a Region within the last 90 days.

LookupEvents returns recent Insights events for trails that enable Insights. To view Insights events for an event data store, you can run queries on your Insights event data store, and you can also view the Lake dashboard for Insights.

Lookup supports the following attributes for management events:

  • Amazon Web Services access key

  • Event ID

  • Event name

  • Event source

  • Read only

  • Resource name

  • Resource type

  • User name

Lookup supports the following attributes for Insights events:

  • Event ID

  • Event name

  • Event source

All attributes are optional. The default number of results returned is 50, with a maximum of 50 possible. The response includes a token that you can use to get the next page of results.

The rate of lookup requests is limited to two per second, per account, per Region. If this limit is exceeded, a throttling error occurs.

Table Definition

Column NameColumn Data Type
end_time Input Column

Specifies that only events that occur before or at the specified time are returned. If the specified end time is before the specified start time, an error is returned.

TIMESTAMP_S
event_category Input Column

Specifies the event category. If you do not specify an event category, events of the category are not returned in the response. For example, if you do not specify insight as the value of EventCategory, no Insights events are returned.

VARCHAR
lookup_attributes Input Column

Contains a list of lookup attributes. Currently the list can contain only one item.

STRUCT(
    "attribute_key" VARCHAR,
    "attribute_value" VARCHAR
)[]
Show child fields
lookup_attributes[]
Show child fields
lookup_attributes[].attribute_key

Specifies an attribute on which to filter the events returned.

lookup_attributes[].attribute_value

Specifies a value for the specified AttributeKey.

The maximum length for the AttributeValue is 2000 characters. The following characters ('_', ' ', ',', '\\n') count as two characters towards the 2000 character limit.

start_time Input Column

Specifies that only events that occur after or at the specified time are returned. If the specified start time is after the specified end time, an error is returned.

TIMESTAMP_S
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
access_key_id

The Amazon Web Services access key ID that was used to sign the request. If the request was made with temporary security credentials, this is the access key ID of the temporary credentials.

VARCHAR
cloud_trail_event

A JSON string that contains a representation of the event returned.

VARCHAR
event_id

The CloudTrail ID of the event returned.

VARCHAR
event_name

The name of the event returned.

VARCHAR
event_source

The Amazon Web Services service to which the request was made.

VARCHAR
event_time

The date and time of the event returned.

TIMESTAMP_S
read_only

Information about whether the event is a write event or a read event. 

VARCHAR
resources

A list of resources referenced by the event returned.

STRUCT(
    "resource_type" VARCHAR,
    "resource_name" VARCHAR
)[]
Show child fields
resources[]
Show child fields
resources[].resource_name

The name of the resource referenced by the event returned. These are user-created names whose values will depend on the environment. For example, the resource name might be "auto-scaling-test-group" for an Auto Scaling Group or "i-1234567" for an EC2 Instance.

resources[].resource_type

The type of a resource referenced by the event returned. When the resource type cannot be determined, null is returned. Some examples of resource types are: Instance for EC2, Trail for CloudTrail, DBInstance for Amazon RDS, and AccessKey for IAM. To learn more about how to look up and filter events by the resource types supported for a service, see Filtering CloudTrail Events.

username

A user name or role name of the requester that called the API in the event returned.

VARCHAR