Last active
April 26, 2022 17:56
-
-
Save rdsedmundo/8ba233fd7eb5ad2b465232ceea706d63 to your computer and use it in GitHub Desktop.
cloudtrail
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/ | |
| ( echo "Time,Identity ARN,Event ID,Service,Action,Error,Message"; | |
| aws cloudtrail lookup-events --start-time "2020-01-01T00:00:00Z" --end-time "2020-01-01T23:59:59Z" --query "Events[*].CloudTrailEvent" --output text \ | |
| | jq -r ". | select(.userIdentity.arn == \"your-arn\" and .eventType == \"AwsApiCall\" and .errorCode != null | |
| and (.errorCode | ascii_downcase | (contains(\"accessdenied\") or contains(\"unauthorized\")))) | |
| | [.eventTime, .userIdentity.arn, .eventID, .eventSource, .eventName, .errorCode, .errorMessage] | @csv" | |
| ) | column -t -s'",' |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment