aws-cloudtrail-lake-query-statement
CloudTrail Lake SQL can contain literal values used in investigations; query text is submitted in plaintext and appears in query metadata.
Where it sits
| location | StartQuery request.QueryStatement |
|---|
| location kind | query_text |
|---|
| data kinds | credential password api_key sensitive_data |
|---|
| emits edge | ContainsSecret |
|---|
| service | CloudTrail (aws:cloudtrail) |
|---|
Collection recipe
| access mode | write_only_input |
|---|
| operation | StartQuery |
|---|
| response path | request.QueryStatement |
|---|
| encoding | string |
|---|
| params | {"QueryStatement": "\u003cSQL\u003e"} |
|---|
Required permissions
cloudtrail:StartQuery
References