Centralising CloudTrail for an AWS Organization and querying it with Athena during investigations
During an investigation we needed to know who changed a security group in one of 14 AWS accounts three months earlier, and the logs were gone. How we set up one organization trail into a protected log archive account, an Athena table with partition projection, and the queries we use most.