in automated-actions/AWS_RISK_CREDENTIALS_EXPOSED/lambda_functions/lookup_cloudtrail_events.py [0:0]
def get_events(username, starttime, endtime):
""" Retrieves detailed list of CloudTrail events that occured between the specified time interval.
Args:
username (string): Username to lookup CloudTrail events for.
starttime(datetime): Start of interval to lookup CloudTrail events between.
endtime(datetime): End of interval to lookup CloudTrail events between.
Returns:
(dict)
Dictionary containing list of CloudTrail events occuring between the start and end time with detailed information for each event.
"""
try:
response = cloudtrail.lookup_events(
LookupAttributes=[
{
'AttributeKey': 'Username',
'AttributeValue': username
},
],
StartTime=starttime,
EndTime=endtime,
MaxResults=50
)
except Exception as e:
print(e)
print('Unable to retrieve CloudTrail events for user "{}"'.format(username))
raise(e)
return response