diff --git a/cmd/flags.go b/cmd/flags.go index 3c27171..506d6b1 100644 --- a/cmd/flags.go +++ b/cmd/flags.go @@ -48,6 +48,16 @@ var Flags = []cli.Flag{ Usage: "Filter events with user name", Required: false, }, + &cli.StringFlag{ + Name: "resource-name", + Usage: "Filter events with resource name", + Required: false, + }, + &cli.StringFlag{ + Name: "resource-type", + Usage: "Filter events with resource type", + Required: false, + }, &cli.StringFlag{ Name: "event-source", Usage: "Filter events with event source", diff --git a/cmd/wrapper.go b/cmd/wrapper.go index a639ebd..2076ac0 100644 --- a/cmd/wrapper.go +++ b/cmd/wrapper.go @@ -14,6 +14,8 @@ func Wrapper(c *cli.Context) { c.String("event-id"), c.String("event-name"), c.String("user-name"), + c.String("resource-name"), + c.String("resource-type"), c.String("event-source"), c.String("access-key-id"), c.Bool("read-only"), diff --git a/pkg/utils/handlers.go b/pkg/utils/handlers.go index bcc588d..8728107 100644 --- a/pkg/utils/handlers.go +++ b/pkg/utils/handlers.go @@ -14,7 +14,7 @@ import ( "github.com/jedib0t/go-pretty/v6/text" ) -func EventsHandler(profile, region string, startTime, endTime *time.Time, eventId, eventName, userName, eventSource, accessKeyId string, readOnly, noReadOnly bool, maxResults int, errorOnly, truncateUserName, truncateUserAgent bool) { +func EventsHandler(profile, region string, startTime, endTime *time.Time, eventId, eventName, userName, resourceName, resourceType, eventSource, accessKeyId string, readOnly, noReadOnly bool, maxResults int, errorOnly, truncateUserName, truncateUserAgent bool) { // do nothing if maxResults is invalid input if maxResults <= 0 { log.Fatalf("Can not pass --max-results with a value lower or equal to 0.\n") @@ -45,6 +45,8 @@ func EventsHandler(profile, region string, startTime, endTime *time.Time, eventI readOnly, noReadOnly, userName, + resourceName, + resourceType, eventSource, accessKeyId, ), diff --git a/pkg/utils/utils.go b/pkg/utils/utils.go index 57659dd..3be0b08 100644 --- a/pkg/utils/utils.go +++ b/pkg/utils/utils.go @@ -79,7 +79,7 @@ func LookupEvents(ctx context.Context, svc *cloudtrail.Client, input *cloudtrail return events[:returnSize], nil } -func composeLookupAttributesInput(eventId, eventName string, readOnly, noReadOnly bool, userName, eventSource, accessKeyId string) []ctypes.LookupAttribute { +func composeLookupAttributesInput(eventId, eventName string, readOnly, noReadOnly bool, userName, resourceName, resourceType, eventSource, accessKeyId string) []ctypes.LookupAttribute { lookupAttributesInput := []ctypes.LookupAttribute{} // LookupAttributeKeyEventId @@ -129,6 +129,24 @@ func composeLookupAttributesInput(eventId, eventName string, readOnly, noReadOnl lookupAttributesInput = append(lookupAttributesInput, attrUserName) } + // LookupAttributeKeyResourceName + if len(resourceName) > 0 { + attrResourceName := ctypes.LookupAttribute{ + AttributeKey: ctypes.LookupAttributeKeyResourceName, + AttributeValue: aws.String(resourceName), + } + lookupAttributesInput = append(lookupAttributesInput, attrResourceName) + } + + // LookupAttributeKeyResourceType + if len(resourceType) > 0 { + attrResourceType := ctypes.LookupAttribute{ + AttributeKey: ctypes.LookupAttributeKeyResourceType, + AttributeValue: aws.String(resourceType), + } + lookupAttributesInput = append(lookupAttributesInput, attrResourceType) + } + // LookupAttributeKeyEventSource const EVENT_SOURCE_SUFFIX = ".amazonaws.com" if len(eventSource) > len(EVENT_SOURCE_SUFFIX) && strings.HasSuffix(eventSource, EVENT_SOURCE_SUFFIX) {