How can I create Cloudtrail trail to log events of only a specific user/resource

Question

How can we monitor API usage only a specific user in Amazon-Web-Services.
I tried creating Cloudtrail trail but it logs events of all users' all activity to the s3 bucket I configured to log it to.
I want only events (all activity) for a particular IAM User / Resource (using arn) to log to a S3 bucket

Answer 1

CloudTrail logs everything. You’ll have to use some other tool to filter what you need and dig deep into the logs. Some of the tools are:

• AWS CloudWatch Logs Insights
• ElasticSearch / Kibana
• GreyLog
• Splunk / SumoLogic / ...

There are many log parsing tools around to choose from.

Hope that helps :)