Table: aws_cloudtrail_event_data_store - Query AWS CloudTrail Event Data using SQL

The AWS CloudTrail Event Data is an AWS service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. It allows you to log, continuously monitor, and retain account activity related to actions across your AWS infrastructure. The service provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services.

Table Usage Guide

The aws_cloudtrail_event_data_store table in Steampipe provides you with information about API activity in your AWS accounts. This includes details about your API calls, logins, and other events captured by AWS CloudTrail. This table allows you, as a DevOps engineer, to query event-specific details, including event names, event sources, and related metadata. You can utilize this table to gather insights on API activity, such as identifying unusual API calls, tracking login activity, and monitoring changes to your AWS resources. The schema outlines the various attributes of the CloudTrail event for you, including the event ID, event time, event name, and user identity.

Examples

Basic info

Explore the status and configuration of your AWS CloudTrail event data stores, including when they were created and their current settings. This can help you maintain security and compliance by ensuring features like multi-region access, organization-wide access, and termination protection are enabled as needed.

select
  name,
  arn,
  status,
  created_timestamp,
  multi_region_enabled,
  organization_enabled,
  termination_protection_enabled
from
  aws_cloudtrail_event_data_store;

select
  name,
  arn,
  status,
  created_timestamp,
  multi_region_enabled,
  organization_enabled,
  termination_protection_enabled
from
  aws_cloudtrail_event_data_store;

List event data stores which are not enabled

Identify instances where event data stores in the AWS CloudTrail service are not enabled. This query is useful in pinpointing potential security vulnerabilities or areas in your system that may not be properly logging and storing event data.

select
  name,
  arn,
  status,
  created_timestamp,
  multi_region_enabled,
  organization_enabled,
  termination_protection_enabled
from
  aws_cloudtrail_event_data_store
where
  status <> 'ENABLED';

select
  name,
  arn,
  status,
  created_timestamp,
  multi_region_enabled,
  organization_enabled,
  termination_protection_enabled
from
  aws_cloudtrail_event_data_store
where
  status != 'ENABLED';

List event data stores with termination protection disabled

Determine the areas in which event data stores have termination protection disabled in your AWS CloudTrail. This is useful to identify potential vulnerabilities and ensure data safety.

select
  name,
  arn,
  status,
  created_timestamp,
  multi_region_enabled,
  organization_enabled,
  termination_protection_enabled
from
  aws_cloudtrail_event_data_store
where
  not termination_protection_enabled;

select
  name,
  arn,
  status,
  created_timestamp,
  multi_region_enabled,
  organization_enabled,
  termination_protection_enabled
from
  aws_cloudtrail_event_data_store
where
  termination_protection_enabled = 0;

Schema for aws_cloudtrail_event_data_store

Name	Type	Operators	Description
_ctx	jsonb		Steampipe context in JSON form.
account_id	text	=, !=, ~~, ~~, !~~, !~~	The AWS Account ID in which the resource is located.
advanced_event_selectors	jsonb		The advanced event selectors that were used to select events for the data store.
akas	jsonb		Array of globally unique identifier strings (also known as) for the resource.
arn	text	=	The Amazon Resource Name (ARN) of the event data store.
billing_mode	text		The billing mode for the event data store.
created_timestamp	timestamp with time zone		The timestamp of the event data store's creation.
federation_role_arn	text		If Lake query federation is enabled, provides the ARN of the federation role used to access the resources for the federated event data store.
federation_status	text		Indicates the Lake query federation status.
kms_key_id	text		Specifies the KMS key ID that encrypts the events delivered by CloudTrail.
multi_region_enabled	boolean		Indicates whether the event data store includes events from all regions, or only from the region in which it was created.
name	text		The name of the event data store.
organization_enabled	boolean		Indicates that an event data store is collecting logged events for an organization.
partition	text		The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
region	text		The AWS Region in which the resource is located.
retention_period	bigint		The retention period, in days.
sp_connection_name	text	=, !=, ~~, ~~, !~~, !~~	Steampipe connection name.
sp_ctx	jsonb		Steampipe context in JSON form.
status	text		The status of an event data store.
termination_protection_enabled	boolean		Indicates whether the event data store is protected from termination.
title	text		Title of the resource.
updated_timestamp	timestamp with time zone		The timestamp showing when an event data store was updated, if applicable. UpdatedTimestamp is always either the same or newer than the time shown in CreatedTimestamp.

Export

This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.

You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh script:

/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- aws

You can pass the configuration to the command with the --config argument:

steampipe_export_aws --config '<your_config>' aws_cloudtrail_event_data_store