CloudTrail Partitioner
CloudTrail Partitioner is a tool that automates the setup and management of partitioned Amazon Athena tables for AWS CloudTrail logs. The tool creates partitioned tables for each AWS account in the format cloudtrail_000000000000 and generates a unified view that combines all account tables. The solution includes automated nightly partition updates through a CDK (Cloud Development Kit) application that runs at 0600 UTC daily. When deployed manually, it creates 90 days of historical partitions, while the automated nightly process creates partitions for the current day and the following day. The tool is designed to improve query performance and cost efficiency when analyzing CloudTrail logs in Athena by organizing data into time-based partitions. It supports multi-account environments by creating separate tables for each account while providing a consolidated view for cross-account analysis. The project is based on Alex Smolen's work on partitioning CloudTrail logs and is suitable for organizations with moderate CloudTrail log volumes (up to approximately 100GB). For larger scale deployments, the creator recommends using the cloudtrail-parquet-glue project which addresses scalability limitations.
FEATURES
EXPLORE BY TAGS
SIMILAR TOOLS
AWS Vault securely stores AWS IAM credentials in the operating system's keystore and generates temporary credentials for development environments.
FestIn discovers open S3 buckets associated with a domain using crawling and DNS reconnaissance techniques.
Kube-bench is a security assessment tool that validates Kubernetes deployments against CIS Kubernetes Benchmark standards through automated configuration checks.
A search engine for open Amazon S3 buckets and their contents, allowing users to search for files using keywords, filename extensions, and full path.
A deprecated Kubernetes workload policy enforcement tool that helped secure multi-tenant clusters through various security policies and configurations.
A community-driven repository of pre-built security analytics queries and rules for monitoring and detecting threats in Google Cloud environments across various log sources and activity types.
SkyWrapper analyzes temporary token behaviors in AWS accounts to detect suspicious activities and generates Excel reports with findings summaries.
A setuid implementation of user namespaces that enables running unprivileged containers without root privileges as a secure alternative to traditional container runtimes.
HAWK is a multi-cloud antivirus scanning API that uses CLAMAV and YARA engines to detect malware in AWS S3, Azure Blob Storage, and GCP Cloud Storage objects.
PINNED
A cybersecurity platform that offers vulnerability scanning, Windows Defender and 3rd party AV management, and MFA compliance reporting, among other features.
Proton Pass is a cross-platform password manager that provides encrypted storage, password generation, and security monitoring features with integrated 2FA and dark web monitoring capabilities.
NordVPN is a commercial VPN service that encrypts internet connections and hides IP addresses through a global network of servers, featuring integrated threat protection and multi-device support.
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.