@@ -48,77 +48,77 @@ resource "aws_glue_catalog_table" "cloudtrail_management_events" {
4848 }
4949
5050 columns {
51- name = " eventVersion "
51+ name = " eventversion "
5252 type = " string"
5353 }
5454
5555 columns {
56- name = " userIdentity "
57- type = " struct<type:string,principalId :string,arn:string,accountId :string,invokedBy :string,accessKeyId :string,userName :string,sessionContext :struct<attributes:struct<mfaAuthenticated :string,creationDate :string>,sessionIssuer :struct<type:string,principalId :string,arn:string,accountId :string,userName :string>,ec2RoleDelivery :string,webIdFederationData :struct<federatedprovider:string,attributes:map<string,string>>>>"
56+ name = " useridentity "
57+ type = " struct<type:string,principalid :string,arn:string,accountid :string,invokedby :string,accesskeyid :string,username :string,sessioncontext :struct<attributes:struct<mfaauthenticated :string,creationdate :string>,sessionissuer :struct<type:string,principalid :string,arn:string,accountid :string,username :string>,ec2roledelivery :string,webidfederationdata :struct<federatedprovider:string,attributes:map<string,string>>>>"
5858 }
5959
6060 columns {
61- name = " eventTime "
61+ name = " eventtime "
6262 type = " string"
6363 }
6464
6565 columns {
66- name = " eventSource "
66+ name = " eventsource "
6767 type = " string"
6868 }
6969
7070 columns {
71- name = " eventName "
71+ name = " eventname "
7272 type = " string"
7373 }
7474
7575 columns {
76- name = " awsRegion "
76+ name = " awsregion "
7777 type = " string"
7878 }
7979
8080 columns {
81- name = " sourceIpAddress "
81+ name = " sourceipaddress "
8282 type = " string"
8383 }
8484
8585 columns {
86- name = " userAgent "
86+ name = " useragent "
8787 type = " string"
8888 }
8989
9090 columns {
91- name = " errorCode "
91+ name = " errorcode "
9292 type = " string"
9393 }
9494
9595 columns {
96- name = " errorMessage "
96+ name = " errormessage "
9797 type = " string"
9898 }
9999
100100 columns {
101- name = " requestParameters "
101+ name = " requestparameters "
102102 type = " string"
103103 }
104104
105105 columns {
106- name = " responseElements "
106+ name = " responseelements "
107107 type = " string"
108108 }
109109
110110 columns {
111- name = " additionalEventData "
111+ name = " additionaleventdata "
112112 type = " string"
113113 }
114114
115115 columns {
116- name = " requestId "
116+ name = " requestid "
117117 type = " string"
118118 }
119119
120120 columns {
121- name = " eventId "
121+ name = " eventid "
122122 type = " string"
123123 }
124124
@@ -128,43 +128,43 @@ resource "aws_glue_catalog_table" "cloudtrail_management_events" {
128128 }
129129
130130 columns {
131- name = " eventType "
131+ name = " eventtype "
132132 type = " string"
133133 }
134134
135135 columns {
136- name = " apiVersion "
136+ name = " apiversion "
137137 type = " string"
138138 }
139139
140140 columns {
141- name = " readOnly "
141+ name = " readonly "
142142 type = " string"
143143 }
144144
145145 columns {
146- name = " recipientAccountId "
146+ name = " recipientaccountid "
147147 type = " string"
148148 }
149149
150150 columns {
151- name = " serviceEventDetails "
151+ name = " serviceeventdetails "
152152 type = " string"
153153 }
154154
155155 columns {
156- name = " sharedEventID "
156+ name = " sharedeventid "
157157 type = " string"
158158 }
159159
160160 columns {
161- name = " vpcEndpointId "
161+ name = " vpcendpointid "
162162 type = " string"
163163 }
164164
165165 columns {
166- name = " tlsDetails "
167- type = " struct<tlsVersion :string,cipherSuite :string,clientProvidedHostHeader :string>"
166+ name = " tlsdetails "
167+ type = " struct<tlsversion :string,ciphersuite :string,clientprovidedhostheader :string>"
168168 }
169169 }
170170
@@ -181,42 +181,42 @@ resource "aws_glue_catalog_table" "glue_catalog_management_events_view" {
181181 view_original_text = " /* Presto View: ${ base64encode (jsonencode ({
182182 originalSql = <<- EOF
183183SELECT
184- eventVersion ,
185- userIdentity ,
186- eventTime ,
187- eventSource ,
188- eventName ,
189- awsRegion ,
190- sourceIpAddress ,
191- userAgent ,
192- errorCode ,
193- errorMessage ,
194- requestParameters ,
195- responseElements ,
196- additionalEventData ,
197- requestId ,
198- eventId ,
184+ eventversion ,
185+ useridentity ,
186+ eventtime ,
187+ eventsource ,
188+ eventname ,
189+ awsregion ,
190+ sourceipaddress ,
191+ useragent ,
192+ errorcode ,
193+ errormessage ,
194+ requestparameters ,
195+ responseelements ,
196+ additionaleventdata ,
197+ requestid ,
198+ eventid ,
199199 resources,
200- eventType ,
201- apiVersion ,
202- readOnly ,
203- recipientAccountId ,
204- serviceEventDetails ,
205- sharedEventID ,
206- vpcEndpointId ,
207- tlsDetails ,
200+ eventtype ,
201+ apiversion ,
202+ readonly ,
203+ recipientaccountid ,
204+ serviceeventdetails ,
205+ sharedeventid ,
206+ vpcendpointid ,
207+ tlsdetails ,
208208 year,
209209 month,
210210 day,
211211 year AS import_year,
212212 month AS import_month,
213213 day AS import_day,
214214 concat(year, month, day) AS import_date,
215- json_extract_scalar(requestParameters , '$.databaseName ') AS database_name,
216- json_extract_scalar(requestParameters , '$.tableName ') AS table_name
215+ json_extract_scalar(requestparameters , '$.databasename ') AS database_name,
216+ json_extract_scalar(requestparameters , '$.tablename ') AS table_name
217217FROM "${ aws_glue_catalog_database . metastore . name } "."${ aws_glue_catalog_table . cloudtrail_management_events . name } "
218- WHERE eventSource = 'glue.amazonaws.com'
219- AND eventName IN (
218+ WHERE eventsource = 'glue.amazonaws.com'
219+ AND eventname IN (
220220 -- Database operations
221221 'CreateDatabase', 'GetDatabase', 'GetDatabases', 'UpdateDatabase', 'DeleteDatabase',
222222 -- Table operations
0 commit comments