aws-athena查询语句总结

完全归于本人mysql语句小白,是一点也写不出来,故汇总到此

1. cloudtrail
bash 复制代码
## 查询事件排序
SELECT  eventname,eventtime,count(eventname) as num  FROM your_athena_tablename
where eventtime between '2024-11-10' and '2024-11-11' group by eventname,eventtime order by num desc


## 查询具体事件名对应的详细信息
SELECT  *  FROM your_athena_tablename where eventname = 'GetCallerIdentity' and  eventtime between '2024-11-10' and '2024-11-11' limit 50

## 确定 CloudTrail 事件数量导致的成本增长情况
SELECT eventName,count(eventName) AS NumberOfChanges,eventSource
FROM your_athena_tablename
WHERE eventtime >= '2024-11-10T00:00:00Z'and eventtime < '2024-11-11T00:00:00Z'
GROUP BY eventName, eventSource
ORDER BY NumberOfChanges DESC

## 显示特定访问密钥的所有记录的 AWS API 活动
SELECT eventTime, eventName, userIdentity.principalId
FROM your_athena_tablename
WHERE userIdentity.accessKeyId like 'access_key_id'

## 确定您的 EC2 实例的所有安全组更改
SELECT eventname, useridentity.username, sourceIPAddress, eventtime, requestparameters
FROM your_athena_tablename
WHERE (requestparameters like '%sg-5887f224%' or requestparameters like '%sg-e214609e%' or requestparameters like '%eni-6c5ca5a8%')
and eventtime > '2017-02-15T00:00:00Z'
order by eventtime asc;

## 显示过去 24 小时内的所有控制台登录信息
SELECT useridentity.username, sourceipaddress, eventtime, additionaleventdata
FROM your_athena_tablename
WHERE eventname = 'ConsoleLogin'
and eventtime >= '2017-02-17T00:00:00Z'
and eventtime < '2017-02-18T00:00:00Z';

## 显示过去 24 小时内所有失败的控制台登录尝试
SELECT useridentity.username, sourceipaddress, eventtime, additionaleventdata
FROM your_athena_tablename
WHERE eventname = 'ConsoleLogin'
and useridentity.username = 'HIDDEN_DUE_TO_SECURITY_REASONS'
and eventtime >= '2017-02-17T00:00:00Z'
and eventtime < '2017-02-18T00:00:00Z';

## 确定缺少的 IAM 权限
SELECT count (*) as TotalEvents, useridentity.arn, eventsource, eventname, errorCode, errorMessage
FROM your_athena_tablename
WHERE (errorcode like '%Denied%' or errorcode like '%Unauthorized%')
AND eventtime >= '2019-10-28T00:00:00Z'
AND eventtime < '2019-10-29T00:00:00Z'
GROUP by eventsource, eventname, errorCode, errorMessage, useridentity.arn
ORDER by eventsource, eventname

## 如果结果未显示失败的 API 调用,则通过类似于下面这样的方法扩大查询范围:
SELECT count (*) as TotalEvents, useridentity.arn, eventsource, eventname, errorCode, errorMessage
FROM your_athena_tablename
WHERE errorcode <> ''
AND eventtime >= '2019-10-28T00:00:00Z'
AND eventtime < '2019-10-29T00:00:00Z'
GROUP by eventsource, eventname, errorCode, errorMessage, useridentity.arn
ORDER by eventsource, eventname
相关推荐
AKAMAI7 小时前
Sport Network 凭借 Akamai 实现卓越成就
人工智能·云原生·云计算
10岁的博客13 小时前
《云计算如何驱动企业数字化转型:关键技术与实践案例》
云计算
m0_694845571 天前
教你使用服务器如何搭建数据库
linux·运维·服务器·数据库·云计算
shinelord明1 天前
【数据行业发展】可信数据空间~数据价值的新型基础设施
大数据·架构·云计算·创业创新
XINVRY-FPGA1 天前
XCKU15P-2FFVA1760I AMD 赛灵思 Xilinx Kintex UltraScale+ FPGA
arm开发·嵌入式硬件·阿里云·fpga开发·云计算·硬件工程·fpga
王道长服务器 | 亚马逊云2 天前
一个迁移案例:从传统 IDC 到 AWS 的真实对比
java·spring boot·git·云计算·github·dubbo·aws
世间小小鱼2 天前
【爬坑指南】亚马逊文件中心 AWS S3 预签名URL 前端直传
前端·云计算·aws
TG_yunshuguoji2 天前
亚马逊云代理商:AWS亚马逊云的独特优势与实用价值
服务器·云计算·aws
阿雄不会写代码2 天前
AWS strands agents 当智能体作为独立服务/容器部署时,它们无法共享进程内状态
云计算·aws
广州腾科助你拿下华为认证2 天前
华为HCIE-云计算培训课程有哪些?
华为·云计算·hcie认证