Skip to content

Instantly share code, notes, and snippets.

@dstokes
Last active November 18, 2016 22:28
Show Gist options
  • Save dstokes/53c74986855ebfafb981a865b6867ab1 to your computer and use it in GitHub Desktop.
Save dstokes/53c74986855ebfafb981a865b6867ab1 to your computer and use it in GitHub Desktop.
Cloudtrail calls by key ID
#!/bin/bash
shopt -s lastpipe
exec 3> >(egrep '^EVENTS' | egrep -o '{.+}' | json -gac 'this.userIdentity && this.userIdentity.accessKeyId == "<UR_KEY>"')
NEXT=""
TOKEN=""
COUNT=0
while [ -n "$TOKEN" ] || [ $COUNT -eq 0 ]; do
test -n "$TOKEN" && NEXT="--next-token '$TOKEN'"
aws cloudtrail --profile stagebloc --region us-east-1 lookup-events --max-results 10 $NEXT --output text \
| tee >(cat - >&3) \
| head -n1 | read TOKEN;
COUNT=$(($COUNT + 1))
sleep 0.8
done
exec 3>&-
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment