--- title: "AWS CloudTrail CLI [Cheat Sheet] - Cybr" description: "AWS CloudTrail CLI cheat sheet in both downloadable image format and text-based format for reference with the most commonly used commands." url: https://cybr.com/cloud-security/aws-cloudtrail-cli-cheat-sheet/ --- # AWS CloudTrail CLI \[Cheat Sheet\] Here’s a CloudTrail CLI cheat sheet in both downloadable image format and text format for reference. AWS CloudTrail Downloadable CLI Cheat Sheet Please note this… Christophe Published March 20, 2024 Here’s a CloudTrail CLI cheat sheet in both downloadable image format and text format for reference. ## AWS CloudTrail Downloadable CLI Cheat Sheet [View the CloudTrail CLI cheat sheet →](https://cybr.com/cheat-sheets/cloudtrail-cli/) *Please note this is not a comprehensive list of all commands or how to use them. These are some of the most commonly used commands and scenarios. If you’re looking for a full list of CloudTrail CLI commands, [refer to the official documentation](https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudtrail/index.html).* ## General and Operational Commands List trails in your AWS account: ``` aws cloudtrail list-trails ``` Shows settings for one or more trails for the specified region (or current region if not specified): ``` aws cloudtrail describe-trails [--trail-name-list ] [--region ] ``` Create a new trail ``` aws cloudtrail create-trail --name --s3-new-bucket [--include-global-service-events] [--is-multi-region-trail] [--enable-log-file-validation] [--cloud-watch-logs-log-group-arn ] [--cloud-watch-logs-role-arn ] [--kms-key-id ] ``` List names and settings of all trails: ``` aws cloudtrail describe-trails [--output json] ``` Get the status of a trail: ``` aws cloudtrail add-tags —resource-id —tags-list “Key=log-events,Value=management” ``` ## Event History and Insights Events See a list of the latest events in JSON format ``` lookup-events —max-items 1 [--output json] ``` Instead of a max, you can specify a time range ``` lookup-events --start-time --end-time ``` Example ``` aws cloudtrail lookup-events --start-time "2023-11-15, 5:00PM" --end-time "2023-11-15, 6:00 PM" --output json ``` We can also query by using a single attribute, like this: ``` aws cloudtrail lookup-events --lookup-attributes AttributeKey=,AttributeValue= ``` Example – you think an access key has been compromised and has been used by a threat actor. You can query the last 10 events related to that access key like this: ``` aws cloudtrail lookup-events --lookup-attributes AttributeKey=AccessKeyId,AttributeValue=EXAMPLE_KEY_ID_HERE --max-items 10 ``` ## Working with Trails Log file location: ``` bucket_name/prefix_name/AWSLogs/Account ID/CloudTrail/region/YYYY/MM/DD/file_name.json.gz ``` Search through log files manually: Example (uses jq) ``` find . -type f -exec jq '.Records[].userIdentity.arn' {} \; ``` This will search all files in our directory, then run the `jq` command looking for `userIdentity.arn`. Note that this is case sensitive, so if you capitalize the `User` for example, it won’t find anything. Example ``` find . -type f -exec jq -r '.Records[] | [.eventTime, .sourceIPAddress, .userIdentity.arn, .eventName] | join(" -- ")' {} \; | sort ``` ## CloudTrail Lake Crete and manage event data stores ``` create-event-data-store --name [--advanced-event-selectors ] ``` Return info about a specific event data store: ``` get-event-data-store --event-data-store # The ARN (or ID suffix of the ARN) ``` List all event data stores Returns an array of `EventDataStores[]` ``` list-event-data-stores ``` Starts/stops ingesting live events for a specific event data store: ``` start-event-data-store-ingestion --event-data-store # The ARN (or ID suffix of the ARN) stop-event-data-store-ingestion --event-data-store ``` Create a channel to ingest events from a partner or external source. ``` create-channel --name --source --destinations # Event data stores to send events from this channel to ``` Returns a channel’s info: ``` get-channel --channel ``` List all channels: ``` list-channels ``` Returns metadata about a query: ``` aws cloudtrail describe-query --event-data-store ac1e7a13-… --query-id 95f234dd-… ``` Get the results of a query run in Lake ``` get-query-results --query-id ``` Example ``` aws cloudtrail get-query-results --query-id 95f234dd-… ``` List all queries run in the last 7 days ``` list-queries --event-data-store ``` Example ``` aws cloudtrail list-queries --event-data-store 2cbe7a73-… ``` Imports data from logged trail events in S3 to an event data store for Lake queries: ``` start-import [--destinations ] [--import-source ] [--start-event-time ] [--end-event-time ] ``` Runs a CloudTrail Lake query `--query-statement` is the SQL code to run `--query-parameters` is the list of query parameters ``` start-query [--query-statement ] [--delivery-s3-uri ] [--query-parameters ] ``` ## Insights Events Enables Insights event logging for an existing trail or event data store `--insights-selectors` are the insights types you want to log (APICallRateInsight and/or ApiErrorRateInsight): ``` put-insight-selectors [--trail-name ] --insight-selectors [--event-data-store ] [--insights-destination ] ``` Retrieve settings for Isngihts event selectors configured for trails or event data stores: ``` get-insight-selectors [--trail-name ][--event-data-store ] ``` ## Record Contents Records that make up CloudTrail log events: [](https://media.cybr.com/2024/03/cloudtrail-record-contents.jpg) ## Learn how to use and configure CloudTrail properly for security with our [free course](https://cybr.com/courses/beginners-guide-to-aws-cloudtrail-for-security/): [![Beginner's Guide to AWS CloudTrail for Security Course](https://media.cybr.com/2023/11/beginner-cloudtrail-banner-v2.jpeg)](https://cybr.com/courses/beginners-guide-to-aws-cloudtrail-for-security/) ## \> [More AWS Security cheat sheets](https://cybr.com/tag/aws-security-cheat-sheets/) < ## Filed under - [Cloud Security](https://cybr.com/cloud-security/) - [AWS](https://cybr.com/tag/aws/) - [AWS Security](https://cybr.com/tag/aws-security/) - [AWS Security Cheat Sheets](https://cybr.com/tag/aws-security-cheat-sheets/) - [Cheat Sheets](https://cybr.com/tag/cheat-sheets/) - [Cloud Security](https://cybr.com/tag/cloud-security/) ## Comments Loading comments… Recommended resources [![Explore the AWS Certified Security Specialty course](https://media.cybr.com/2023/12/cybr-aws-security-specialty-banner-768x432.jpg)](https://cybr.com/courses/aws-certified-security-specialty-course/) ## Build practical AWS security skills Start with the core services, then prepare for the AWS Certified Security Specialty exam with guided lessons and hands-on practice. [Introduction to AWS Security](https://cybr.com/courses/introduction-to-aws-security/) [Security Specialty course](https://cybr.com/courses/aws-certified-security-specialty-course/)