GitHub - aws-samples/cloud-trail-lake-query-samples

AWS CloudTrail Lake query samples

This repository contains a collection of sample queries for AWS CloudTrail Lake. The samples are designed to educate AWS customers on how to implement queries to investigate compliance data. They are organized by various samples for AWS CloudTrail Lake to return compliance data. We will continue to add more queries to this repository as they are developed and verified.

Security

See CONTRIBUTING for more information.

License

This library is licensed under the MIT-0 License. See the LICENSE file.

Name		Name	Last commit message	Last commit date
Latest commit History 18 Commits
CODE_OF_CONDUCT.md		CODE_OF_CONDUCT.md
CONTRIBUTING.md		CONTRIBUTING.md
ConfigItemCountQuery.sql		ConfigItemCountQuery.sql
ConfigTableCreation.sql		ConfigTableCreation.sql
EstimateAmountOfConfigurationItems.sql		EstimateAmountOfConfigurationItems.sql
LICENSE		LICENSE
MostEvaluatedConfigRule.sql		MostEvaluatedConfigRule.sql
README.md		README.md
SelfAssumeRole.sql		SelfAssumeRole.sql
activity-performed-by-IP-address.sql		activity-performed-by-IP-address.sql
aurora-databases-with-performance-insights.sql		aurora-databases-with-performance-insights.sql
aurora-mysql-databases-with-instance-class-information.sql		aurora-mysql-databases-with-instance-class-information.sql
aurora-postgresql-databases-with availability-zone-information.sql		aurora-postgresql-databases-with availability-zone-information.sql
aws-support-access.sql		aws-support-access.sql
cloudtrail-configuration-changes.sql		cloudtrail-configuration-changes.sql
console-login-with-no-mfa.sql		console-login-with-no-mfa.sql
cross-account-access.sql		cross-account-access.sql
data-by-week-day.sql		data-by-week-day.sql
database-failover-information.sql		database-failover-information.sql
database-reboot-information.sql		database-reboot-information.sql
db-cluster-point-in-time-restore.sql		db-cluster-point-in-time-restore.sql
dynamodb-scan-operations.sql		dynamodb-scan-operations.sql
ec2-api-run-instances.sql		ec2-api-run-instances.sql
ec2-events.sql		ec2-events.sql
ec2-public-security-group.sql		ec2-public-security-group.sql
ec2-security-historical-changes.sql		ec2-security-historical-changes.sql
event-response-element-by-event-id.sql		event-response-element-by-event-id.sql
find-snapshots-not-encrypted.sql		find-snapshots-not-encrypted.sql
iam-access-key-activity.sql		iam-access-key-activity.sql
iam-access-key-success-activity.sql		iam-access-key-success-activity.sql
iam-idc-authenticate-api.sql		iam-idc-authenticate-api.sql
iam-idc-federate-api-by-idc-user.sql		iam-idc-federate-api-by-idc-user.sql
iam-idc-user-count-and-group-activity.sql		iam-idc-user-count-and-group-activity.sql
iam-idc-user-create-iam-role.sql		iam-idc-user-create-iam-role.sql
iam-idc-user-create-iam-user-acces-keys.sql		iam-idc-user-create-iam-user-acces-keys.sql
iam-idc-user-create-iam-user.sql		iam-idc-user-create-iam-user.sql
iam-idc-user-denied-activity.sql		iam-idc-user-denied-activity.sql
iam-idc-user-modify-iam-policy.sql		iam-idc-user-modify-iam-policy.sql
iam-idc-user-mutable-actions.sql		iam-idc-user-mutable-actions.sql
iam-principal-by-launched-ec2-instance-id.sql		iam-principal-by-launched-ec2-instance-id.sql
iam-role-activity.sql		iam-role-activity.sql
iam-role-assumed-by-iam-access-key.sql		iam-role-assumed-by-iam-access-key.sql
list-all-S3-PutObjects-Encryption-status.sql		list-all-S3-PutObjects-Encryption-status.sql
list-all-errors-for-s3-events.sql		list-all-errors-for-s3-events.sql
list-all-events-in-a-flatten-table-format.sql		list-all-events-in-a-flatten-table-format.sql
list-all-events-not-in-authorized-region.sql		list-all-events-not-in-authorized-region.sql
list-all-manually-created-resources.sql		list-all-manually-created-resources.sql
list-attempted-s3-requests..sql		list-attempted-s3-requests..sql
list-events-with-errors.sql		list-events-with-errors.sql
list-publicly-accessible-rds-instances.sql		list-publicly-accessible-rds-instances.sql
list-write-events-from-management-console.sql		list-write-events-from-management-console.sql
logs-by-region.sql		logs-by-region.sql
rds-db-deleted-with-no-snapshot.sql		rds-db-deleted-with-no-snapshot.sql
resourceCompliance.sql		resourceCompliance.sql
s3-actions-by-iam-access-key.sql		s3-actions-by-iam-access-key.sql
s3-buckets-public-access-block-historical-changes.sql		s3-buckets-public-access-block-historical-changes.sql
s3-buckets-using-acls.sql		s3-buckets-using-acls.sql
ssm-patch-compliance-all-ec2-instances-time-range.sql		ssm-patch-compliance-all-ec2-instances-time-range.sql
ssm-patch-compliance-all-ec2-instances.sql		ssm-patch-compliance-all-ec2-instances.sql
ssm-patch-compliance-distinct-ec2-instance-latest.sql		ssm-patch-compliance-distinct-ec2-instance-latest.sql
ssm-patch-compliance-selected-ec2-instance-time-range.sql		ssm-patch-compliance-selected-ec2-instance-time-range.sql
ssm-patch-compliance-selected-ec2-instance.sql		ssm-patch-compliance-selected-ec2-instance.sql
tag-history-by-resource.sql		tag-history-by-resource.sql
tls-unsupported-version.sql		tls-unsupported-version.sql
tls-version.sql		tls-version.sql
top-actions-by-iam-role.sql		top-actions-by-iam-role.sql
top-errors.sql		top-errors.sql
top-iam-actions-by-principal.sql		top-iam-actions-by-principal.sql
top-s3-actions.sql		top-s3-actions.sql
top-s3-objects.sql		top-s3-objects.sql
user-added-to-admin-group.sql		user-added-to-admin-group.sql
users-by-account.sql		users-by-account.sql

License

aws-samples/cloud-trail-lake-query-samples

Folders and files

Latest commit

History