Zenn
Open4

cloudtrailログをawscliで検索する

AWS
cloudtrail
not75743not75743

5個イベントログを取得する

$ aws cloudtrail lookup-events --max-items 5
not75743not75743

Event NameがStopinstances

$ aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=StopInstances --max-items 1
not75743not75743

出力

{
    "Events": [
        {
            "EventId": "4fa1dfcf-a3b3-458c-87ad-ce86579bb8a4",
            "EventName": "StopInstances",
            "ReadOnly": "false",
            "AccessKeyId": "略",
            "EventTime": "2023-06-03T11:00:50+09:00",
            "EventSource": "ec2.amazonaws.com",
            "Username": "略",
            "Resources": [
                {
                    "ResourceType": "AWS::EC2::Instance",
                    "ResourceName": "i-076557c4cb054d23b"
                }
            ],
            "CloudTrailEvent": "略"
        }
    ],
    "NextToken": "略"
}

長いしわかりにくいからawscliで見る必要はないね...
見れるってだけ、athenaのほうがよいかな