Skip to content

Instantly share code, notes, and snippets.

@junkangli

junkangli/CloudTrailEC2InstanceChanges.filter

Created March 6, 2019 10:32
Show Gist options
  • Save junkangli/f8182383c053624883e323de9a5f712d to your computer and use it in GitHub Desktop.
Save junkangli/f8182383c053624883e323de9a5f712d to your computer and use it in GitHub Desktop.
Download ZIP
This is a metric filter to search for CloudTrailEC2InstanceChanges alerts in CloudWatch Log of CloudTrail events.
Raw
CloudTrailEC2InstanceChanges.filter
{ ($.eventSource="ec2.amazonaws.com") && ($.userIdentity.type="IAMUser") }
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment