aws_cloudtrail_lookup_events
Query AWS CloudTrail management events to monitor account activity. Filter by event name, resource type, or user to investigate security incidents and audit API usage.
Instructions
Look up recent CloudTrail management events. Filter by event name, resource type, user name, etc. Returns the last 90 days by default.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| profile | No | AWS profile name from ~/.aws/config (e.g., 'default', 'production') | |
| region | No | AWS region override (e.g., 'us-east-1', 'sa-east-1') | |
| lookup_attributes | No | Lookup filters (e.g., [{"AttributeKey": "EventName", "AttributeValue": "ConsoleLogin"}]) | |
| start_time | No | Start time (ISO 8601 format) | |
| end_time | No | End time (ISO 8601 format) | |
| max_results | No | Maximum events to return (default: 50) |