(PowerShell) Download S3 CloudTrail Log and Un-Gzip

Demonstrates how to download a Amazon CloudTrail log from an S3 bucket. The file in this example is a .json.gz. The file is uncompressed and the JSON parsed.

Chilkat .NET Downloads Chilkat .NET Assemblies

Add-Type -Path "C:\chilkat\ChilkatDotNet47-9.5.0-x64\ChilkatDotNet47.dll"

# This requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

$http = New-Object Chilkat.Http

$http.AwsAccessKey = "AWS_ACCESS_KEY"
$http.AwsSecretKey = "AWS_SECRET_KEY"
$http.S3Ssl = $true
$http.AwsRegion = "us-west-2"
$http.AwsEndpoint = "s3-us-west-2.amazonaws.com"

$bucketName = "chilkat.logs"
$objectName = "/AWSLogs/957491831129/CloudTrail/us-west-1/2016/11/12/957491831129_CloudTrail_us-west-1_20161112T1335Z_umXfD4RxHE5nDGuI.json.gz"
$localFilePath = "qa_output/cloudTrailLog.json.gz"

$success = $http.S3_DownloadFile($bucketName,$objectName,$localFilePath)
if ($success -ne $true) {
    $($http.LastErrorText)
    exit
}

$statusCode = $http.LastStatus
if ($statusCode -ne 200) {
    $("Failed to download, response status code = " + $statusCode)
    exit
}

$jsonPath = "qa_output/cloudTrailLog.json"
$gzip = New-Object Chilkat.Gzip
$success = $gzip.UncompressFile($localFilePath,$jsonPath)
if ($success -eq $false) {
    $($gzip.LastErrorText)
    exit
}

$json = New-Object Chilkat.JsonObject
$json.LoadFile($jsonPath)
$json.EmitCompact = $false
$($json.Emit())

# Sample JSON is shown below.
# Go to http://tools.chilkat.io/jsonParse.cshtml 
# and copy/paste the JSON into the online tool to generate parsing code.

# {
#   "Records": [
#     {
#       "eventVersion": "1.05",
#       "userIdentity": {
#         "type": "Root",
#         "principalId": "954591834127",
#         "arn": "arn:aws:iam::954591834127:root",
#         "accountId": "954591834127",
#         "accessKeyId": "ASIAJ3DEMXUXI43B6FYQ",
#         "sessionContext": {
#           "attributes": {
#             "mfaAuthenticated": "false",
#             "creationDate": "2016-11-12T13:09:31Z"
#           }
#         }
#       },
#       "eventTime": "2016-11-12T13:34:39Z",
#       "eventSource": "cloudtrail.amazonaws.com",
#       "eventName": "DescribeTrails",
#       "awsRegion": "us-west-1",
#       "sourceIPAddress": "98.228.98.57",
#       "userAgent": "console.amazonaws.com",
#       "requestParameters": {
#         "trailNameList": [
#         ]
#       },
#       "responseElements": null,
#       "requestID": "c2a0376c-a8dc-11e6-89e7-85ac5ce5ee56",
#       "eventID": "eb5afd70-dae1-41f0-82b4-91c3c936d9ba",
#       "eventType": "AwsApiCall",
#       "recipientAccountId": "954591834127"
#     }
#   ]
# }