aws cloudtrail lookup-events

SafeWho did what (CloudTrail)

aws cloudtrail lookup-events --lookup-attributes AttributeKey=ResourceName,AttributeValue=<res>

Traces API calls — the primary source for 'who deleted that and when' investigations.

Examples

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=TerminateInstancesTermination history

Syntax

aws cloudtrail lookup-events [--lookup-attributes k=v] [--start-time t]

Before you run it

Read only.

Related commands

az monitor activity-log listQuery the activity log
aws iam list-usersAudit IAM users/keys

The same reference, with no signal at all

Every command on this site, held on your device. The app adds 632 more: 1,510 commands and 120 fix flows, searchable with no connection. Free to install, no ads (some content is a one-time purchase).

Get it free on the App Store