Skip to content

aaalzand/cloud-trail-lake-query-samples

BranchesTags
 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

16 Commits
CODE_OF_CONDUCT.md
CODE_OF_CONDUCT.md
 
 
CONTRIBUTING.md
CONTRIBUTING.md
 
 
LICENSE
LICENSE
 
 
README.md
README.md
 
 
SelfAssumeRole.sql
SelfAssumeRole.sql
 
 
activity-performed-by-IP-address.sql
activity-performed-by-IP-address.sql
 
 
aurora-databases-with-performance-insights.sql
aurora-databases-with-performance-insights.sql
 
 
aurora-mysql-databases-with-instance-class-information.sql
aurora-mysql-databases-with-instance-class-information.sql
 
 
aurora-postgresql-databases-with availability-zone-information.sql
aurora-postgresql-databases-with availability-zone-information.sql
 
 
aws-support-access.sql
aws-support-access.sql
 
 
cloudtrail-configuration-changes.sql
cloudtrail-configuration-changes.sql
 
 
console-login-with-no-mfa.sql
console-login-with-no-mfa.sql
 
 
cross-account-access.sql
cross-account-access.sql
 
 
data-by-week-day.sql
data-by-week-day.sql
 
 
database-failover-information.sql
database-failover-information.sql
 
 
database-reboot-information.sql
database-reboot-information.sql
 
 
db-cluster-point-in-time-restore.sql
db-cluster-point-in-time-restore.sql
 
 
dynamodb-scan-operations.sql
dynamodb-scan-operations.sql
 
 
ec2-api-run-instances.sql
ec2-api-run-instances.sql
 
 
ec2-events.sql
ec2-events.sql
 
 
ec2-public-security-group.sql
ec2-public-security-group.sql
 
 
ec2-security-historical-changes.sql
ec2-security-historical-changes.sql
 
 
event-response-element-by-event-id.sql
event-response-element-by-event-id.sql
 
 
find-snapshots-not-encrypted.sql
find-snapshots-not-encrypted.sql
 
 
iam-access-key-activity.sql
iam-access-key-activity.sql
 
 
iam-access-key-success-activity.sql
iam-access-key-success-activity.sql
 
 
iam-idc-authenticate-api.sql
iam-idc-authenticate-api.sql
 
 
iam-idc-federate-api-by-idc-user.sql
iam-idc-federate-api-by-idc-user.sql
 
 
iam-idc-user-count-and-group-activity.sql
iam-idc-user-count-and-group-activity.sql
 
 
iam-idc-user-create-iam-role.sql
iam-idc-user-create-iam-role.sql
 
 
iam-idc-user-create-iam-user-acces-keys.sql
iam-idc-user-create-iam-user-acces-keys.sql
 
 
iam-idc-user-create-iam-user.sql
iam-idc-user-create-iam-user.sql
 
 
iam-idc-user-denied-activity.sql
iam-idc-user-denied-activity.sql
 
 
iam-idc-user-modify-iam-policy.sql
iam-idc-user-modify-iam-policy.sql
 
 
iam-idc-user-mutable-actions.sql
iam-idc-user-mutable-actions.sql
 
 
iam-principal-by-launched-ec2-instance-id.sql
iam-principal-by-launched-ec2-instance-id.sql
 
 
iam-role-activity.sql
iam-role-activity.sql
 
 
iam-role-assumed-by-iam-access-key.sql
iam-role-assumed-by-iam-access-key.sql
 
 
list-all-S3-PutObjects-Encryption-status.sql
list-all-S3-PutObjects-Encryption-status.sql
 
 
list-all-errors-for-s3-events.sql
list-all-errors-for-s3-events.sql
 
 
list-all-events-in-a-flatten-table-format.sql
list-all-events-in-a-flatten-table-format.sql
 
 
list-all-events-not-in-authorized-region.sql
list-all-events-not-in-authorized-region.sql
 
 
list-all-manually-created-resources.sql
list-all-manually-created-resources.sql
 
 
list-attempted-s3-requests..sql
list-attempted-s3-requests..sql
 
 
list-events-with-errors.sql
list-events-with-errors.sql
 
 
list-publicly-accessible-rds-instances.sql
list-publicly-accessible-rds-instances.sql
 
 
list-write-events-from-management-console.sql
list-write-events-from-management-console.sql
 
 
logs-by-region.sql
logs-by-region.sql
 
 
rds-db-deleted-with-no-snapshot.sql
rds-db-deleted-with-no-snapshot.sql
 
 
s3-actions-by-iam-access-key.sql
s3-actions-by-iam-access-key.sql
 
 
s3-buckets-public-access-block-historical-changes.sql
s3-buckets-public-access-block-historical-changes.sql
 
 
s3-buckets-using-acls.sql
s3-buckets-using-acls.sql
 
 
ssm-patch-compliance-all-ec2-instances-time-range.sql
ssm-patch-compliance-all-ec2-instances-time-range.sql
 
 
ssm-patch-compliance-all-ec2-instances.sql
ssm-patch-compliance-all-ec2-instances.sql
 
 
ssm-patch-compliance-distinct-ec2-instance-latest.sql
ssm-patch-compliance-distinct-ec2-instance-latest.sql
 
 
ssm-patch-compliance-selected-ec2-instance-time-range.sql
ssm-patch-compliance-selected-ec2-instance-time-range.sql
 
 
ssm-patch-compliance-selected-ec2-instance.sql
ssm-patch-compliance-selected-ec2-instance.sql
 
 
tag-history-by-resource.sql
tag-history-by-resource.sql
 
 
tls-unsupported-version.sql
tls-unsupported-version.sql
 
 
tls-version.sql
tls-version.sql
 
 
top-actions-by-iam-role.sql
top-actions-by-iam-role.sql
 
 
top-errors.sql
top-errors.sql
 
 
top-iam-actions-by-principal.sql
top-iam-actions-by-principal.sql
 
 
top-s3-actions.sql
top-s3-actions.sql
 
 
top-s3-objects.sql
top-s3-objects.sql
 
 
user-added-to-admin-group.sql
user-added-to-admin-group.sql
 
 
users-by-account.sql
users-by-account.sql
 
 

Repository files navigation

AWS CloudTrail Lake query samples

This repository contains a collection of sample queries for AWS CloudTrail Lake. The samples are designed to educate AWS customers on how to implement queries to investigate compliance data. They are organized by various samples for AWS CloudTrail Lake to return compliance data. We will continue to add more queries to this repository as they are developed and verified.

Security

See CONTRIBUTING for more information.

License

This library is licensed under the MIT-0 License. See the LICENSE file.

About

No description, website, or topics provided.

Resources

Readme

License

MIT-0 license

Code of conduct

Code of conduct
Activity

Stars

0 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

No releases published

Packages

No packages published