Ken Citron
I didn’t understand this filter: "{ $.userIdentity.type = "Root" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != "AwsServiceEvent" }". Can someone explain each part?
2 Answers
Michael O’Lear
AWS lists this page for explanations on their filter and pattern syntax:
https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html
The filter you mention is also referenced at:
Mldavie
There is updated guidance on this topic at https://aws.amazon.com/premiumsupport/knowledge-center/root-user-account-cloudwatch-rule/