CODEWITHSUNDEEP
amazon-web-servicesamazon-ec2
tsap
tsap

Reputation: 813

How to check who stopped an EC2 instance?

Is there a way (for example in CLI) to check what user stopped an instance? There is some data in the console:

State transition reason: User initiated (2017-07:24 10:15:42 GMT)
State transition reason message: Client.UserInitiatedShutdown: User initiated shutdown

Upvotes: 5

Views: 9972

Answers (1)

John Rotenstein
John Rotenstein

Reputation: 269091

Amazon CloudTrail can be used to create an Audit Trail of most API requests made to AWS. It records the time, IP address, user and request details.

However, you will need to configure CloudTrail before it captures this information because you will need to specify an Amazon S3 bucket where it can store the data. Therefore, you won't be able to see who stopped your instance this time, but if you configure CloudTrail you'll be able to do it in future.

Upvotes: 5

Related Questions