The query returned nothing. The logs were empty. Something was wrong.
AWS CloudTrail had been recording every API call, but hunting through its data by hand was slow and error‑prone. Cloud environments generate terabytes of event logs. Without a repeatable process, investigations stall. That is where Git CloudTrail Query Runbooks come in.
A Git‑based runbook is source‑controlled automation. With CloudTrail queries in Git, every search, filter, and join is documented, versioned, and observable. Runbooks replace static notes with executable steps. You commit queries like code, track changes, and share them across teams.
Start by defining a CloudTrail SQL or Athena query that targets the event patterns you care about—roles assumed without MFA, changes to security groups, or root account activity. Store this query in a Git repository alongside a simple run script. This script runs the query, outputs results to a timestamped file, and sends alerts if results are not empty.
The Git workflow makes incident response faster. Clone the repo, run the scripted query, and see the results in seconds. Every executed runbook becomes part of your audit trail. Branches let you experiment without breaking production queries. Pull requests provide peer review to catch errors before they impact monitoring.
Integrating Git CloudTrail Query Runbooks with CI/CD pipelines turns them into continuous checks. You can run them on a schedule or trigger them on configuration changes. Logs are no longer archives; they are active signals in your security posture.
Put the repository under tight access controls and mirror it across regions. This protects your runbooks the same way you protect your application code. Combine them with CloudTrail event selectors to reduce noise and focus only on behaviors that matter.
Git CloudTrail Query Runbooks make AWS audit data actionable. They shorten the path from detection to understanding. They turn CloudTrail from raw logs into a live monitoring system.
Build your first runbook now and push it to Git. Connect it to CloudTrail. See the power of automated queries live in minutes at hoop.dev.