list_recent_cloudtrail_events
Retrieve recent AWS CloudTrail events to monitor console access and configuration changes for security auditing and compliance tracking.
Instructions
Lists recent CloudTrail events to track console access and changes.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Number of events to return (default: 10). | |
| lookup_attribute_key | No | Attribute key to filter by (e.g., 'EventName', 'Username'). | |
| lookup_attribute_value | No | Value for the lookup attribute. |
Implementation Reference
- src/index.ts:912-937 (handler)Handler function that executes the tool logic: fetches recent CloudTrail events using LookupEventsCommand with optional limit and lookup attributes, formats and returns the events.
if (name === "list_recent_cloudtrail_events") { const limit = (args as any)?.limit || 10; const lookupKey = (args as any)?.lookup_attribute_key; const lookupValue = (args as any)?.lookup_attribute_value; const commandInput: any = { MaxResults: limit }; if (lookupKey && lookupValue) { commandInput.LookupAttributes = [{ AttributeKey: lookupKey, AttributeValue: lookupValue }]; } const command = new LookupEventsCommand(commandInput); const response = await cloudTrailClient.send(command); const events = response.Events?.map(e => ({ EventId: e.EventId, EventName: e.EventName, EventTime: e.EventTime, Username: e.Username, Resources: e.Resources, CloudTrailEvent: e.CloudTrailEvent ? JSON.parse(e.CloudTrailEvent).userAgent : undefined // Extract user agent if available })) || []; return { content: [{ type: "text", text: JSON.stringify(events, null, 2) }] }; } - src/index.ts:140-159 (registration)Tool registration in the ListTools response, including name, description, and input schema definition.
name: "list_recent_cloudtrail_events", description: "Lists recent CloudTrail events to track console access and changes.", inputSchema: { type: "object", properties: { limit: { type: "number", description: "Number of events to return (default: 10).", }, lookup_attribute_key: { type: "string", description: "Attribute key to filter by (e.g., 'EventName', 'Username')." }, lookup_attribute_value: { type: "string", description: "Value for the lookup attribute." } } } }, - src/index.ts:142-159 (schema)Input schema for the tool parameters: limit, lookup_attribute_key, lookup_attribute_value.
inputSchema: { type: "object", properties: { limit: { type: "number", description: "Number of events to return (default: 10).", }, lookup_attribute_key: { type: "string", description: "Attribute key to filter by (e.g., 'EventName', 'Username')." }, lookup_attribute_value: { type: "string", description: "Value for the lookup attribute." } } } }, - src/index.ts:56-56 (helper)Initialization of the CloudTrailClient used by the handler.
const cloudTrailClient = new CloudTrailClient({}); - src/index.ts:22-22 (helper)Import of CloudTrailClient and LookupEventsCommand used in the handler.
import { CloudTrailClient, LookupEventsCommand } from "@aws-sdk/client-cloudtrail";