Discover User Events

Discover events created by specific user.

Source code • Permissions

If created_before and created_after are not supplied, events are fetched for the last 90 days.

This action will fetch all events for the user in the specified time period and then filter for supplied events.
If you are looking to find a specific event, use Discover Events instead.

For a list of event names, see Event Names.

Usage

Input

Parameter Description Type Required Default Value
user Search events originating from this user string Yes None
events Search for specific events list(string) No None
created_after Search for events created after this time. (YYYY/MM/DD) string No None
created_before Search for events created before this time. (YYYY/MM/DD) string No None
region Region for operation. Leave blank for session default string No Session Default
debug Increase log verbosity bool No False
silent Decrease log verbosity bool No False
output Output format
table		 string No None
session Established session object No None

Output

Returns a list of objects containing discovered events:

[
    {
        'UserName': 'foo',
        'EventTime': '2021-01-01T00:00:00Z',
        'EventName': 'DetachVolume',
        'Resources': '["vol-1234567890abcdef0", "i-1234567890abcdef0"]'
    }
]

Examples

Discover any events created in the last 90 days by user ‘foo’ in eu-west-2:

aaws cloudtrail discover_user_events --user foo --region eu-west-2

Discover if user ‘foo’ has terminated any instances in eu-west-2 between Jan 5, 2024 and Jan 10, 2024:

aaws cloudtrail discover_user_events --user foo --events TerminateInstances --created_before 2024/01/10 --created_after 2024/01/05 --region eu-west-2