In this recipe, we queried our logs from the console. We can also query logs from the CLI. The following are some of the important CLI commands for querying CloudTrail logs:
- The aws cloudtrail lookup-events command can be used to query the last 90 days of automatically generated event logs. A pagination token is returned if there are more results.
- We can limit the number of items that are returned by the aws cloudtrail lookup-events command by specifying the max-items option; for example, aws cloudtrail lookup-events --max-items 10.
- We can specify a date range using the start-time and end-time parameters; for example, aws cloudtrail lookup-events --start-time 2019-01-12 --end-time 2019-10-12. We can also specify hours, minutes, ...