events

Creates, updates, deletes, gets or lists an events resource.

Overview

Name	events
Type	Resource
Id	aws.cloudtrail.events

Fields

The following fields are returned by SELECT queries:

lookup_events

Name	Datatype	Description
access_key_id	string	The Amazon Web Services access key ID that was used to sign the request. If the request was made with temporary security credentials, this is the access key ID of the temporary credentials.
cloud_trail_event	string	A JSON string that contains a representation of the event returned.
event_id	string	The CloudTrail ID of the event returned.
event_name	string	The name of the event returned.
event_source	string	The Amazon Web Services service to which the request was made.
event_time	string (date-time)	The date and time of the event returned.
read_only	string	Information about whether the event is a write event or a read event.
resources	array	A list of resources referenced by the event returned.
username	string	A user name or role name of the requester that called the API in the event returned.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
lookup_events	select	region		Looks up management events or CloudTrail Insights events that are captured by CloudTrail. You can look up events that occurred in a Region within the last 90 days. LookupEvents returns recent Insights events for trails that enable Insights. To view Insights events for an event data store, you can run queries on your Insights event data store, and you can also view the Lake dashboard for Insights. Lookup supports the following attributes for management events: Amazon Web Services access key Event ID Event name Event source Read only Resource name Resource type User name Lookup supports the following attributes for Insights events: Event ID Event name Event source All attributes are optional. The default number of results returned is 50, with a maximum of 50 possible. The response includes a token that you can use to get the next page of results. The rate of lookup requests is limited to two per second, per account, per Region. If this limit is exceeded, a throttling error occurs.
restore_event_data_store	exec	region, EventDataStore		Restores a deleted event data store specified by EventDataStore, which accepts an event data store ARN. You can only restore a deleted event data store within the seven-day wait period after deletion. Restoring an event data store can take several minutes, depending on the size of the event data store.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

lookup_events

Looks up management events or CloudTrail Insights events that are captured by CloudTrail. You can look up events that occurred in a Region within the last 90 days. LookupEvents returns recent Insights events for trails that enable Insights. To view Insights events for an event data store, you can run queries on your Insights event data store, and you can also view the Lake dashboard for Insights. Lookup supports the following attributes for management events: Amazon Web Services access key Event ID Event name Event source Read only Resource name Resource type User name Lookup supports the following attributes for Insights events: Event ID Event name Event source All attributes are optional. The default number of results returned is 50, with a maximum of 50 possible. The response includes a token that you can use to get the next page of results. The rate of lookup requests is limited to two per second, per account, per Region. If this limit is exceeded, a throttling error occurs.

SELECT
access_key_id,
cloud_trail_event,
event_id,
event_name,
event_source,
event_time,
read_only,
resources,
username
FROM aws.cloudtrail.events
WHERE region = '{{ region }}' -- required
;

Lifecycle Methods

restore_event_data_store

Restores a deleted event data store specified by EventDataStore, which accepts an event data store ARN. You can only restore a deleted event data store within the seven-day wait period after deletion. Restoring an event data store can take several minutes, depending on the size of the event data store.

EXEC aws.cloudtrail.events.restore_event_data_store 
@region='{{ region }}' --required 
@@json=
'{
"EventDataStore": "{{ EventDataStore }}"
}'
;