Support for filtering with ResourceName and ResourceType

guessi · Jan 2, 2025 · 6e9fb21 · 6e9fb21
1 parent f31d594
commit 6e9fb21
Show file tree

Hide file tree

Showing 4 changed files with 34 additions and 2 deletions.
diff --git a/cmd/flags.go b/cmd/flags.go
@@ -48,6 +48,16 @@ var Flags = []cli.Flag{
 		Usage:    "Filter events with user name",
 		Required: false,
 	},
+	&cli.StringFlag{
+		Name:     "resource-name",
+		Usage:    "Filter events with resource name",
+		Required: false,
+	},
+	&cli.StringFlag{
+		Name:     "resource-type",
+		Usage:    "Filter events with resource type",
+		Required: false,
+	},
 	&cli.StringFlag{
 		Name:     "event-source",
 		Usage:    "Filter events with event source",

diff --git a/cmd/wrapper.go b/cmd/wrapper.go
@@ -14,6 +14,8 @@ func Wrapper(c *cli.Context) {
 		c.String("event-id"),
 		c.String("event-name"),
 		c.String("user-name"),
+		c.String("resource-name"),
+		c.String("resource-type"),
 		c.String("event-source"),
 		c.String("access-key-id"),
 		c.Bool("read-only"),

diff --git a/pkg/utils/handlers.go b/pkg/utils/handlers.go
@@ -14,7 +14,7 @@ import (
 	"github.com/jedib0t/go-pretty/v6/text"
 )
 
-func EventsHandler(profile, region string, startTime, endTime *time.Time, eventId, eventName, userName, eventSource, accessKeyId string, readOnly, noReadOnly bool, maxResults int, errorOnly, truncateUserName, truncateUserAgent bool) {
+func EventsHandler(profile, region string, startTime, endTime *time.Time, eventId, eventName, userName, resourceName, resourceType, eventSource, accessKeyId string, readOnly, noReadOnly bool, maxResults int, errorOnly, truncateUserName, truncateUserAgent bool) {
 	// do nothing if maxResults is invalid input
 	if maxResults <= 0 {
 		log.Fatalf("Can not pass --max-results with a value lower or equal to 0.\n")
@@ -45,6 +45,8 @@ func EventsHandler(profile, region string, startTime, endTime *time.Time, eventI
 			readOnly,
 			noReadOnly,
 			userName,
+			resourceName,
+			resourceType,
 			eventSource,
 			accessKeyId,
 		),

diff --git a/pkg/utils/utils.go b/pkg/utils/utils.go
@@ -79,7 +79,7 @@ func LookupEvents(ctx context.Context, svc *cloudtrail.Client, input *cloudtrail
 	return events[:returnSize], nil
 }
 
-func composeLookupAttributesInput(eventId, eventName string, readOnly, noReadOnly bool, userName, eventSource, accessKeyId string) []ctypes.LookupAttribute {
+func composeLookupAttributesInput(eventId, eventName string, readOnly, noReadOnly bool, userName, resourceName, resourceType, eventSource, accessKeyId string) []ctypes.LookupAttribute {
 	lookupAttributesInput := []ctypes.LookupAttribute{}
 
 	// LookupAttributeKeyEventId
@@ -129,6 +129,24 @@ func composeLookupAttributesInput(eventId, eventName string, readOnly, noReadOnl
 		lookupAttributesInput = append(lookupAttributesInput, attrUserName)
 	}
 
+	// LookupAttributeKeyResourceName
+	if len(resourceName) > 0 {
+		attrResourceName := ctypes.LookupAttribute{
+			AttributeKey:   ctypes.LookupAttributeKeyResourceName,
+			AttributeValue: aws.String(resourceName),
+		}
+		lookupAttributesInput = append(lookupAttributesInput, attrResourceName)
+	}
+
+	// LookupAttributeKeyResourceType
+	if len(resourceType) > 0 {
+		attrResourceType := ctypes.LookupAttribute{
+			AttributeKey:   ctypes.LookupAttributeKeyResourceType,
+			AttributeValue: aws.String(resourceType),
+		}
+		lookupAttributesInput = append(lookupAttributesInput, attrResourceType)
+	}
+
 	// LookupAttributeKeyEventSource
 	const EVENT_SOURCE_SUFFIX = ".amazonaws.com"
 	if len(eventSource) > len(EVENT_SOURCE_SUFFIX) && strings.HasSuffix(eventSource, EVENT_SOURCE_SUFFIX) {