aws_access_key.yaml

"evaluatorId": ""
"queryId": "LW_AWS_ACCESS_KEY"
"queryText":
  "LW_AWS_ACCESS_KEY {
    source {
      CloudTrailRawEvents
    }
    filter {
      contains(EVENT:responseElements, 'ASIA')
    }
    return distinct {
      INSERT_ID,
      INSERT_TIME,
      EVENT_TIME,
      EVENT
    }
  }"