0

I need to retrieve CreateImage and CreateSnapshot events from AWS Cloud Trail using Find-CTEvent cmdlet. So I try the following:

Find-CTEvent -LookupAttribute @(@{ AttributeKey="EventName"; AttributeValue="CreateSnapshot"},@{ AttributeKey="EventName"; AttributeValue="CreateImage"})

And I get events only for the first element in the list. So, where am I wrong? I'd appreciate any help. Thank you.

Sergey
  • 118
  • 1
  • 3
  • 13
  • PIpe results to Format-Table and see if there is any arrays. Most likely you are getting all the results but not viewing the entire array. – jdweng Mar 09 '23 at 07:24

1 Answers1

1

As of 4/5/2023, this doesn't work. You can only provide a single LookupAttribute value per the documentation (https://docs.aws.amazon.com/powershell/latest/reference/items/Find-CTEvent.html)

-LookupAttribute <LookupAttribute[]>
Contains a list of lookup attributes. Currently the list can contain only one item.
Necoras
  • 6,743
  • 3
  • 24
  • 45