AWS awscloudtrail documentation change

Service: awscloudtrail · 2025-05-31 · Documentation low

File: awscloudtrail/latest/userguide/lake-query-generator.md

Summary

Added new example queries for filtering by principal/resource tags and expanded SNS reference

Security assessment

The new queries demonstrate security monitoring patterns (tracking tagged resources, access patterns by operators) but don't address specific vulnerabilities. Enhances documentation of security analysis capabilities.

Diff

diff --git a/awscloudtrail/latest/userguide/lake-query-generator.md b/awscloudtrail/latest/userguide/lake-query-generator.md
index baf7e511b..8cd9538ba 100644
--- a//awscloudtrail/latest/userguide/lake-query-generator.md
+++ b//awscloudtrail/latest/userguide/lake-query-generator.md
@@ -167 +167 @@ If you choose to run the example queries in this section, replace `eds-id` with
-**Prompt:** Give me a list of users that used SNS.
+**Prompt:** Give me a list of users that used Amazon SNS.
@@ -217,0 +218,63 @@ If you choose to run the example queries in this section, replace `eds-id` with
+**Prompt:** Query the number of calls each operator performed on the date 2024-05-01. The operator is a principal tag.
+
+**SQL query:**
+    
+    
+    SELECT element_at(
+            eventContext.tagContext.principalTags,
+            'operator'
+        ) AS operator,
+        COUNT(*) AS eventCount
+    FROM
+        eds-id
+    WHERE eventtime >= '2024-05-01 00:00:00'
+        AND eventtime < '2024-05-01 23:59:59'
+    GROUP BY 1
+    ORDER BY 2 DESC;
+
+**Prompt:** Give me all event IDs that touched resources within the AWS CloudFormation stack with name myStack on the date 2024-05-01.
+
+**SQL query:**
+    
+    
+    SELECT eventID
+    FROM
+        eds-id
+    WHERE any_match(
+            eventContext.tagcontext.resourcetags,
+            rt->element_at(rt.tags, 'aws:cloudformation:stack-name') = 'myStack'
+        )
+        AND eventtime >= '2024-05-01 00:00:00'
+        AND eventtime < '2024-05-01 23:59:59'
+
+**Prompt:** Count the number of events grouped by resource tag 'solution' values, listing them in descending order of count.
+
+**SQL query:**
+    
+    
+    SELECT element_at(rt.tags, 'solution'),
+        count(*) as event_count
+    FROM
+        eds-id,
+        unnest(eventContext.tagContext.resourceTags) as rt
+    WHERE eventtime < '2025-05-14 19:00:00'
+    GROUP BY 1
+    ORDER BY 2 DESC;
+
+**Prompt:** Find all Amazon S3 data events where resource tag Environment has value prod.
+
+**SQL query:**
+    
+    
+    SELECT *
+    FROM
+        eds-id
+    WHERE eventCategory = 'Data'
+        AND eventSource = 's3.amazonaws.com'
+        AND eventtime >= '2025-05-14 00:00:00'
+        AND eventtime < '2025-05-14 20:00:00'
+        AND any_match(
+            eventContext.tagContext.resourceTags,
+            rt->element_at(rt.tags, 'Environment') = 'prod'
+        )
+