cloudtrail_lookup_events
Audit AWS CloudTrail management events with filters for event name, username, resource type, and region. Identify who made changes and from which source IP.
Instructions
Look up AWS CloudTrail management events with optional filters (event name, username, resource type). Useful for auditing who changed what, and from which source IP.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| region | No | AWS region. Empty queries the configured default region (or all regions if unset). | |
| hours_back | No | How many hours back to search. 0 uses the configured default lookback. | |
| event_name | No | Filter by CloudTrail event name (e.g. 'RunInstances'). | |
| username | No | Filter by the IAM username. | |
| resource_type | No | Filter by resource type (e.g. 'AWS::EC2::Instance'). | |
| max_results | No | Maximum events to return (0 = unlimited, capped at 10000). |