我正在编写查询以获取过去一周的 Amazon Athena 记录。这是我到目前为止所写的:
WITH events AS (
SELECT
event.eventVersion,
event.eventID,
event.eventTime,
event.eventName,
event.eventType,
event.eventSource,
event.awsRegion,
event.sourceIPAddress,
event.userAgent,
event.userIdentity.type AS userType,
event.userIdentity.arn AS userArn,
event.userIdentity.principalId as userPrincipalId,
event.userIdentity.accountId as userAccountId,
event.userIdentity.userName as userName
FROM cloudtrail.events
CROSS JOIN UNNEST (Records) AS r (event)
)
SELECT userName,sourceIPAddress,eventName,eventTime FROM events WHERE eventName='ConsoleLogin';
Run Code Online (Sandbox Code Playgroud)
但我不确定如何编写它以仅提取过去 1 周的记录。
aws ×1