AWS CloudTrail Log Parser

CloudTrail JSON is dense, and the answers you want — who did what, on which service, from where, and what failed — are spread across nested objects. AWS CloudTrail Log Parser accepts raw CloudTrail output in any of its common shapes (record arrays, wrapped Records objects, or streaming NDJSON) and flattens each event into extractable fields.

The result is a report of total activity, failures, per-service and per-action counts, the busiest IAM principals and source IPs, and per-region distribution — enough to answer “What happened in my account today?” in one pass.

• All CloudTrail shapes — array, Records wrapper, NDJSON.
• Event field flattening — time, service, action, identity, source.
• Failure detection — errorCode events tallied separately.
• Per-service, action, region, user, IP summaries.
• Copyable report.
• Local only — nothing uploaded.

1. Paste CloudTrail JSON — decompressed event file, SDK stream, or console view.
2. Parse. Event counts and summaries render instantly.
3. Scan the failure and action summaries.
4. Copy the report for the review.

Example 1 — Account review. A day's CloudTrail events group by service and action so a spike of RunInstances stands out immediately.

Example 2 — Access denial hunt. Events carrying AccessDenied are gathered in the failures section with the IAM principal that made them.

Example 3 — Insider activity. Sorting by IAM user and source IP shows a single principal hammering one action from one address.

• Shape-tolerant parser — nearly any CloudTrail export.
• Identity-aware — principal, user, ARN.
• Failures isolated — errors never buried.
• Drillable summaries — service, action, region, IP.
• Private — all processing client-side.