1

We have one role which has 8 policies attached to it. One policy has been removed by someone, now how to identify when it was removed. How to check from cloud trail?

bamishr
  • 410
  • 1
  • 6
  • 23

2 Answers2

3

There are two possible event types, depending on if a managed policy or an inline policy has been removed from the role:

You can filter the CloudTrail event history by either of these to find and analyze the respective events.

Please note that if you haven’t explicitly created a trail in AWS CloudTrail, the events are only retained for 90 days.

Dennis Traub
  • 50,557
  • 7
  • 93
  • 108
-1

I got the answer, I can find it in cloudtrail event history. enter image description here

bamishr
  • 410
  • 1
  • 6
  • 23