2

Currently, I have about 620 snapshots. I am attempting to figure out the different user IDs that created them all.

Using the boto3 code (below), I see there are about 150 snapshots with an ID associated with it. Why don't I see any IDs for the other 470?

Finally, I'm using 'CreateSnaphot/s' as the EventName AttributeValue(s). Are there other verbs I should be looking for which can create a snapshot?

session = boto3.Session(profile_name=profile, region_name=region)
    ct = session.client('cloudtrail')
    response = []
    for verb in ('CreateSnapshots', 'CreateSnapshot'):
        response += ct.lookup_events(
            LookupAttributes=[
                {
                    'AttributeKey': 'EventName',
                    'AttributeValue': verb
                },
            ],
            StartTime=datetime(2015, 1, 1),
            EndTime=datetime(2020, 1, 1),
            MaxResults=1000,
        )['Events']
Tennis Smith
  • 451
  • 6
  • 14
  • I wonder if some of them might be created by the [Amazon Data Lifecycle Manager for EBS](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/snapshot-lifecycle.html)? – John Rotenstein Nov 21 '19 at 20:19
  • That's good question. The answer is no. I checked and there aren't any Lifecycle Manager tasks configured. – Tennis Smith Nov 21 '19 at 21:15

0 Answers0