AWS collect CloudTrail Events in all regions. More general form of aws-list-by-region.sh that handles quoted args. Need to set the times to your needs. Based on Script from Avi K.

aws-trail-by-region.sh

#
#   This only collecting the non read-only actions. This will save a lot of time and space. 
# If you want all events simple remove the --lookup-attributes and the arg.
#
#   To generate the time string use somethng like:
#       date -d "2 days ago" +"%Y-%m-%d, %H:%M"
#   If you don't limit the time range the command will likely timeout.
#
# Can also add --end-time


#CMD='cloudtrail lookup-events --lookup-attributes AttributeKey=ReadOnly,AttributeValue=false  --start-time "2022-03-31, 00:00"  "2022-04-03, 23:59" '

DAYS_AGO=1
CMD='cloudtrail lookup-events --lookup-attributes AttributeKey=ReadOnly,AttributeValue=false  --start-time "$(date -d "$DAYS_AGO days ago" +"%Y-%m-%d, %H:%M")" '


for region in $(aws ec2 describe-regions  --output text | awk {'print $4'})
do
    echo $region && eval aws --region $region "$CMD"  |tee trail.$region.json.log
done

see also aws-list-by-region.sh
https://gist.github.com/AstroTom/390b9f60919781a4019efd40d014c9e5#file-aws-list-by-region-sh