I tried Japanese search using Amazon Q in AWS CloudTrail
This page has been translated by machine translation. View original
Introduction
With the update on September 15, 2026, AWS CloudTrail enhanced its integration with Amazon Q Console, adding support for log investigation in natural language including Japanese.
Even in situations where the use of Athena or CloudWatch Logs Insights is restricted, there are times when you still want to investigate "who did what." To verify how far this integration can be leveraged in such cases, I entered four questions in Japanese and reviewed the responses.
How to Launch Amazon Q Console
In this environment, no activation or setup was required (assuming you have Q usage permissions and CloudTrail reference permissions). Clicking the Q icon at the top of the management console opens a panel on the right side. You can ask questions while the CloudTrail dashboard is displayed.
What I Tried
Checking a User's Operation History
What operations did [username] perform in the past 24 hours?
Q searched trails with multi-region support and returned the operation history in a table with User, Action, Resource, and Count columns.
The response also includes Q's own operations (such as Q:SendMessage). If you only want to check operations performed by humans, you will need to exclude Q's operations from the results.
Investigating Services with High Resource Creation and Deletion Activity
Next, I expanded the period to one week for aggregation.
Which services had the most resource creations and deletions in the past week?
Q presented the number of creations and deletions by service in the following table.
| Service | Created | Deleted | Total |
|---|---|---|---|
| IAM | 119 | 91 | 210 |
| ECS | 23 | 29 | 52 |
| CloudFormation | 10 | 11 | 21 |
| EC2 | 9 | 9 | 18 |
| CloudWatch Logs | 3 | 0 | 3 |
| Lambda | 1 | 1 | 2 |
In addition to the aggregated results, Q also showed trends in recurring operations. However, since these are inferences based on resource name patterns, individual event verification is required for auditing purposes.
Investigating Failed API Calls
I asked this question with the assumption of identifying insufficient permissions or configuration errors.
How many API calls failed (resulted in errors) in the past 24 hours?
Q identified the cause for each error code, assessed the actual impact, and summarized that "all 13 cases were minor, and no suspicious operations were found."
Checking IAM Changes Made via CLI or SDK
I entered a question combining multiple conditions.
Were there any operations that changed IAM roles or policies from outside the console (via CLI or SDK) in the past week?
Q identified 10 matching cases and returned a list with the date and time, target role, and the CLI command that was executed. Only one prompt was needed, though Q switched its retrieval method several times internally before returning the results.
Summary
All four prompts returned responses in Japanese, allowing me to check user operation history, resource creation and deletion status, failed API calls, and IAM changes made via CLI or SDK.
With CloudTrail's event history, you can investigate by specifying filter conditions, but you need to know in advance which attributes to narrow down by. The integration with Amazon Q now makes it possible to start investigations from questions written in Japanese.
For investigating large volumes of logs, Athena or LogsInsights may still be necessary, but please try Amazon Q as one of the convenient investigation tools for CloudTrail.
