AWS CloudTrail Log Analyzer

Load CloudTrail JSON and see who did what, from where and when, with high-risk API calls filtered out - entirely in your browser, and never asking for cloud credentials.

Runs locally

Everything happens in your browser. What you paste or drop here is never uploaded, logged or stored.

Drop CloudTrail files

The JSON files CloudTrail delivers to S3 (after gunzip), Event history JSON/CSV exports, or JSON Lines. Several files are merged. Nothing is uploaded.

Or paste CloudTrail JSON

Flag access-denied errors per principal from

Also list RunInstances, StartInstances and GetSecretValue

Who did what, from where, and when

Each CloudTrail record says which identity called which API, from which address and region, and whether it worked. The analyzer counts principals, services, API names, regions, source addresses and error codes, and draws a timeline. It then lists the calls that change the security posture of the account, grouped by why they matter:

identity and access changes (new users, access keys, policy attachments, trust policies, MFA removal);
logging and detection turned off (StopLogging, DeleteTrail, GuardDuty and Config changes);
data exposure (bucket policies, ACLs, public access blocks, shared snapshots and images);
secrets and keys;
network exposure;
account and organisation changes.

Findings with evidence

Some events are raised as findings, each with the principal, address and time:

root user activity;
console sign-in without MFA;
failed console sign-ins;
security groups opened to 0.0.0.0/0 or ::/0;
logging being stopped;
a principal collecting many AccessDenied errors;
one identity active across many regions.

No credentials, ever

This tool never asks for AWS keys and never calls AWS. Download the log files yourself, from the S3 bucket your trail writes to or from Event history in the console, and drop them here. Everything is read in your browser, and closing the tab discards it.

Frequently asked questions

My files end in .json.gz - what do I do?

Decompress them first (most archive tools and gunzip do it). Several files can be dropped at once; their Records arrays are combined.

Is every listed call suspicious?

No. These calls are how accounts are administered. The list shows where to look; your change records say which were expected.

Does it cover data events?

Yes, if your trail records them (S3 object-level, Lambda invoke). They appear in counts and the table like any other event.

References

Related tools

What this tool can and cannot tell you. It reports what is present in the input you provide. It cannot see anything you did not give it, and a clean result means nothing was found in that input - not that the wider system is secure.

Security guidance here follows current published sources - OWASP, MDN, the relevant RFCs, NIST, CISA, FIRST and MITRE - which are linked beside the specific claims they support.