m6tFauw7

1CREATE EXTERNAL TABLE IF NOT EXISTS cloudtrail_logs (
2eventVersion STRING,
3userIdentity STRUCT<
4               type:STRING,
5               principalId:STRING,
6               arn:STRING,
7               accountId:STRING,
8               invokedBy:STRING,
9               accessKeyId:STRING,
10               userName:STRING,
11sessionContext:STRUCT<
12attributes:STRUCT<
13               mfaAuthenticated:STRING,
14               creationDate:STRING>,
15sessionIssuer:STRUCT<  
16               type:STRING,
17               principalId:STRING,
18               arn:STRING, 
19               accountId:STRING,
20               userName:STRING>>>,
21eventTime STRING,
22eventSource STRING,
23eventName STRING,
24awsRegion STRING,
25sourceIpAddress STRING,
26userAgent STRING,
27errorCode STRING,
28errorMessage STRING,
29requestParameters STRING,
30responseElements STRING,
31additionalEventData STRING,
32requestId STRING,
33eventId STRING,
34resources ARRAY<STRUCT<
35               arn:STRING,
36               accountId:STRING,
37               type:STRING>>,
38eventType STRING,
39apiVersion STRING,
40readOnly STRING,
41recipientAccountId STRING,
42serviceEventDetails STRING,
43sharedEventId STRING,
44vpcEndpointId STRING
45)
46
47ROW FORMAT SERDE 'com.amazon.emr.hive.serde.CloudTrailSerde'
48STORED AS INPUTFORMAT 'com.amazon.emr.cloudtrail.CloudTrailInputFormat'
49OUTPUTFORMAT 'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'
50LOCATION 's3://bucket/AWSLogs/account_id/CloudTrail/us-east-1/'