Simple shell script to query AWS CloudTrail for particular actions in an AWS account

query_cloudtrail.sh

#!/bin/bash

# The following shell script uses Amazon Athena to query AWS CloudTrail logs for any occurrences of the
# action sagemaker:ListNotebookInstances.  The query returns the user identity who invoked the API, along
# with the region where the API was called.  A simple count of the number of invokes is outputted as a
# result.

SQL="SELECT useridentity.arn, eventname, eventsource, awsregion, sourceipaddress, errorcode, eventtime FROM cloudtrail_logs_account_logging WHERE eventsource = 'sagemaker.amazonaws.com' AND eventname in ('ListNotebookInstances') AND eventtime > '2020-04-15' LIMIT 3;"

EXEC_ID=$(aws athena start-query-execution --query-string "$SQL" --result-configuration OutputLocation=s3://my-s3-logging-bucket/queries --query 'QueryExecutionId' --output text)
echo Started execution ID $EXEC_ID

STATUS=$(aws athena get-query-execution --query-execution-id $EXEC_ID --query 'QueryExecution.Status.State' --output text)
while [ $STATUS == 'RUNNING' ]
do
    echo Query has status $STATUS
    sleep 5
    STATUS=$(aws athena get-query-execution --query-execution-id $EXEC_ID --query 'QueryExecution.Status.State' --output text)
done

REC_COUNT=$(aws athena get-query-results --query-execution-id $EXEC_ID --query 'ResultSet.Rows[*].Data[*].VarCharValue' --output text | wc -l)
echo Action was invoked at least $REC_COUNT times this month