With so much valuable data within your CloudTrail logs, finding effective ways to query the data for specific entries can be made easier when using Amazon Athena.
Amazon Athena is a serverless service that allows you to easily analyze data being stored within Amazon S3, such as your CloudTrail logs, using an interactive query service that uses standard SQL. As a result, it is a very effective service to help you scan huge datasets. The configuration of Amazon Athena is outside of the scope of this book; however, more information on this service can be found at https://aws.amazon.com/athena/.
Making your logs available to Athena to enable enhanced querying is a simple process:
- From within the AWS Management Console, select AWS CloudTrail.
- Select the Event history option from the left menu:
- Select Run advanced queries in Amazon Athena:
- From the Storage location drop-down list, select the S3 bucket that contains your CloudTrail...