Root account activity

The root account shouldn’t be doing much of anything day to day, so anything it does is worth a look. This pulls the last 30 days of root activity — tune the window and add filters once you know your baseline.

SELECT
  eventtime,
  eventname,
  eventsource,
  sourceipaddress,
  useragent
FROM cloudtrail_logs
WHERE useridentity.type = 'Root'
  AND from_iso8601_timestamp(eventtime) > date_add('day', -30, now())
ORDER BY eventtime DESC;