Instace Type Change log

Question

How do I find out when the Instance size was changed using Cloudtrail? e.g. large -xlarge date, user and so on. One of the instance size have been changed and I'd like to find out which user has changed it

Answer 1

The Logging Amazon EC2, Amazon EBS, and Amazon VPC API Calls with AWS CloudTrail documentation states that:

All Amazon EC2, Amazon EBS, and Amazon VPC actions are logged by CloudTrail and are documented in the Amazon EC2 API Reference.

The Amazon EC2 API Reference shows that the action you're looking for is the one called ModifyInstanceAttribute; in your case you should target events that have "eventName": "ModifyInstanceAttribute" and have the instanceType key in the requestParameters object. The identity of the user (or role) that initiated the action is in userIdentity.

An example of such event in CloudTrail is:

{
    "eventVersion": "1.05",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "XXXXXXXXXXX",
        "arn": "arn:aws:iam::XXXXXXXXXX:user/my_user",
        "accountId": "XXXXXXXXXX",
        "accessKeyId": "XXXXXXXXXX",
        "userName": "my_user",
        "sessionContext": {
            "sessionIssuer": {},
            "webIdFederationData": {},
            "attributes": {
                "mfaAuthenticated": "true",
                "creationDate": "2020-11-26T15:49:37Z"
            }
        }
    },
    "eventTime": "2020-11-26T16:54:18Z",
    "eventSource": "ec2.amazonaws.com",
    "eventName": "ModifyInstanceAttribute",
    "awsRegion": "eu-west-1",
    "sourceIPAddress": "111.22.33.444",
    "userAgent": "console.ec2.amazonaws.com",
    "requestParameters": {
        "instanceId": "i-08999dedafc4xxyyz",
        "instanceType": {
            "value": "t3.nano"
        }
    },
    "responseElements": {
        "requestId": "11111111-2222-472f-ad77-bbeb506b242d",
        "_return": true
    },
    "requestID": "11111111-2222-472f-ad77-bbeb506b242d",
    "eventID": "aaaaaaa-c757-4501-8889-4f9d90720c0c",
    "eventType": "AwsApiCall",
    "recipientAccountId": "XXXXXXXXXX"
}