AWS - Top API calls by User

MZMPR6

Every 5 minutes, this datasource will query ElasticSearch for a list of the top 20 API callers as identified by the "userIdentity.sessionContext.sessionIssuer.userName" identity.  This should return a list of users that are running under automation as opposed to user accounts.  This will also return the number of calls that are being throttled by AWS as outlined here:  http://docs.aws.amazon.com/AWSEC2/latest/APIReference/query-api-troubleshooting.html

Use this datasource to improve any code you have running in AWS that relies on API calls outside of cloudwatch.  Suggestions on how to improve this datasource are welcome!  We've already used it to find a number of issues and identify code that was not adhering to AWS's API request guidelines.

 

To Apply this datasource, assign the property "CloudTrailES.URL" to your Elasticsearch instance that services cloudtrail log requests. The value of this property should be the search URL endpoint for that Elasticsearch instance (e.g. "https://search-cloudtraillogs-ABCDEFGHIJK12345.us-east-1.es.amazonaws.com/_search")