We can check the automatically populated event logs in CloudTrail as follows:
- Log in to the CloudTrail service in the console. We should see a list of recent events on the dashboard:
- Click on Event history from the left sidebar. This will take us to the Event history page.
We can also go to the Event history page by clicking on the View all events link below the list of recent events.
- Select the User name from the dropdown. Copy and paste one of the usernames from the preceding list and search for all activity from that user for a period of 10 days. I have used a time range of December 1, 2019 to December 10, 2019: