Using Athena to query CloudTrail logs in S3

In this recipe, we will learn how to use Amazon Athena to query CloudTrail logs. Using Athena to query CloudTrail logs provide us with greater flexibility. For example, we cannot filter based on an account ID from the CloudTrail console, even if multiple accounts are sending logs to the CloudTrail's S3 bucket. However, we can use Athena to query for logs from CloudTrail's S3 bucket based on the account ID.

Getting ready

We need to create a trail in CloudTrail to complete this recipe. We can do this by following the Creating a trail in CloudTrail recipe of this chapter.

If we are new to Athena, before we can run our queries, we should set up a query result location in Amazon...