Digging through CloudTrail logs

download_and_search_cloudtrail.sh

aws s3 sync \
  s3://your-cloudtrail/AWSLogs/222222bbbbbb/CloudTrail/us-east-1/YYYY/MM/DD/ \
  ~/s3/your-cloudtrail/AWSLogs/222222bbbbbb/CloudTrail/us-east-1/YYYY/MM/DD/

ag -lz \
  c11db0a3-7309-4089-9750-3835fb522e9d \
  ~/s3/your-cloudtrail/AWSLogs/222222bbbbbb/CloudTrail/us-east-1/YYYY/MM/DD/
  

parse_cloudtrail_events.rb

require 'json'

paths = Dir.glob("#{ENV['HOME']}/s3/your-cloudtrail/AWSLogs/222222bbbbbb/CloudTrail/us-east-1/YYYY/MM/DD/*.json.gz")

events = paths.flat_map do |path|
  JSON.parse(Zlib::GzipReader.new(StringIO.new(File.read(path))).read)['Records']
end