July 2017
Intermediate to advanced
402 pages
9h 38m
English
We just saw how to validate that our logs haven't been tampered with. We can now take advantage of the service to answer specific questions.
The first way to use the tool is simply to use the web interface at https://console.aws.amazon.com/cloudtrail/:

Of course, for more flexibility, you can use the command-line interface and, in particular, the lookup-events option.
For instance, did a user log in to the console on February 25 between 18:30 and 19:30 UTC?:
$ aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin\
--start-time 2017-02-25T18:30:00Z \
--end-time 2017-02-25T19:30:00Z ...Read now
Unlock full access