Search code examples
amazon-web-servicespowershellamazon-cloudtrail

Getting AWS Cloud Trail events using Find-CTEvent with multiple lookup attributes

I need to retrieve CreateImage and CreateSnapshot events from AWS Cloud Trail using Find-CTEvent cmdlet. So I try the following:

Find-CTEvent -LookupAttribute @(@{ AttributeKey="EventName"; AttributeValue="CreateSnapshot"},@{ AttributeKey="EventName"; AttributeValue="CreateImage"})

And I get events only for the first element in the list. So, where am I wrong? I'd appreciate any help. Thank you.

Solution

  • As of 4/5/2023, this doesn't work. You can only provide a single LookupAttribute value per the documentation (https://docs.aws.amazon.com/powershell/latest/reference/items/Find-CTEvent.html)

    -LookupAttribute <LookupAttribute[]>
Contains a list of lookup attributes. Currently the list can contain only one item.