z0ph/accessdenied.sql

Created July 4, 2022 12:51

Star (0) You must be signed in to star a gist
Fork (0) You must be signed in to fork a gist

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/z0ph/4e3e1edfbd3311209d4816cbdc8ed3af.js"></script>
Save z0ph/4e3e1edfbd3311209d4816cbdc8ed3af to your computer and use it in GitHub Desktop.

Download ZIP

For CopyPasteOps Only - Query for CloudWatch Logs Insights on Cloudtrail LogGroup

Raw

accessdenied.sql

	filter errorCode="AccessDenied"
	\| fields eventTime, eventName, eventSource, userIdentity.sessionContext.sessionIssuer.userName

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment