Skip to content

Instantly share code, notes, and snippets.

@z0ph

z0ph/accessdenied.sql

Created July 4, 2022 12:51
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save z0ph/4e3e1edfbd3311209d4816cbdc8ed3af to your computer and use it in GitHub Desktop.
Save z0ph/4e3e1edfbd3311209d4816cbdc8ed3af to your computer and use it in GitHub Desktop.
Download ZIP
For CopyPasteOps Only - Query for CloudWatch Logs Insights on Cloudtrail LogGroup
Raw
accessdenied.sql
filter errorCode="AccessDenied"
| fields eventTime, eventName, eventSource, userIdentity.sessionContext.sessionIssuer.userName
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment