aws-cloudtrail

name	aws-cloudtrail
description	CloudTrail via AWS CLI v2 (`aws cloudtrail`). Trails, event selectors, event data stores, queries, channels, imports.

AWS CLI v2 — CloudTrail

Overview

Complete reference for all aws cloudtrail subcommands in AWS CLI v2. Covers trail management, event selectors, insight selectors, event data stores (CloudTrail Lake), queries, channels, imports, tagging, and event lookup.

Quick Reference — Common Workflows

Create a trail

aws cloudtrail create-trail \
  --name my-trail \
  --s3-bucket-name my-cloudtrail-bucket \
  --is-multi-region-trail \
  --enable-log-file-validation

Start logging for a trail

aws cloudtrail start-logging --name my-trail

Get trail status

aws cloudtrail get-trail-status --name my-trail

Look up recent events

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=RunInstances \
  --max-results 10

Create an event data store (CloudTrail Lake)

aws cloudtrail create-event-data-store \
  --name my-lake-store \
  --retention-period 365 \
  --advanced-event-selectors '[{"Name":"Management","FieldSelectors":[{"Field":"eventCategory","Equals":["Management"]}]}]'

Run a query on CloudTrail Lake

aws cloudtrail start-query \
  --query-statement "SELECT eventName, count(*) as cnt FROM my-eds-id WHERE eventTime > '2024-01-01' GROUP BY eventName ORDER BY cnt DESC"

Put event selectors (data events)

aws cloudtrail put-event-selectors --trail-name my-trail \
  --advanced-event-selectors '[{"Name":"S3DataEvents","FieldSelectors":[{"Field":"eventCategory","Equals":["Data"]},{"Field":"resources.type","Equals":["AWS::S3::Object"]}]}]'

Enable CloudTrail Insights

aws cloudtrail put-insight-selectors --trail-name my-trail \
  --insight-selectors '[{"InsightType":"ApiCallRateInsight"},{"InsightType":"ApiErrorRateInsight"}]'

Command Reference

See index.md for the quick reference table and global options.

Group	File	Commands
Trails	trails.md	create-trail, delete-trail, describe-trails, get-trail, list-trails, update-trail, start-logging, stop-logging
Event Selectors	event-selectors.md	get-event-selectors, put-event-selectors, get-insight-selectors, put-insight-selectors
Event Data Stores	event-data-stores.md	create-event-data-store, delete-event-data-store, describe-event-data-store, get-event-data-store, list-event-data-stores, update-event-data-store, restore-event-data-store, enable-federation, disable-federation
Queries	queries.md	start-query, describe-query, get-query-results, list-queries, cancel-query
Channels	channels.md	create-channel, delete-channel, get-channel, list-channels, update-channel
Imports	imports.md	create-import, get-import, list-imports, start-import
Tags	tags.md	add-tags, remove-tags, list-tags
Events	events.md	lookup-events, get-trail-status