A SysOps administrator noticed that a large number of Elastic IP addresses are being created...

[Reference: Setting Up AWS CloudTrail, Create an Athena Table for CloudTrail Logs:, Set up an Athena table that points to the S3 bucket where CloudTrail logs are stored., Reference: Creating Tables in Athena, Query CloudTrail Logs:, Use Athena to run SQL queries to search for AllocateAddress events, which represent the creation of Elastic IP addresses., Example Query:, sql, Copy code, SELECT userIdentity.userName, eventTime, eventSource, eventName, requestParameters, FROM cloudtrail_logs, WHERE eventName = 'AllocateAddress';, Reference: Analyzing AWS CloudTrail Logs, Review Results:, Review the results to identify which IAM user or role is creating the Elastic IP addresses., Reference: AWS CloudTrail Log Analysis, , , ]