We can set up Athena and query CloudTrail logs as follows:
- Log in to the CloudTrail service in the console.
- Click on Event history from the left sidebar of the CloudTrail dashboard. This will take us to the Event history page.
- Click on Run advanced queries in Amazon Athena from the content area. We should see Create a table in Amazon Athena with a table creation command for reference.
- For Storage location, select the S3 bucket of our trail.
- Click on Create table. We should see a success message with a link for Go to Athena.
- Click on Go to Athena.
- Go to the Query Editor tab. We should get the list of database tables, including the one we created, on the left, and a query editor window on right.
It might take some time for ...