AWS CloudTrail Log Analysis: How to Find Who Did What (And When)

Practical guide to analyzing AWS CloudTrail logs — Athena queries for tracing non-compliant resources, finding who opened SSH to the world, and building your investigation workflow.