Cloudtrail calls by key ID

wtf.sh

#!/bin/bash
shopt -s lastpipe

exec 3> >(egrep '^EVENTS' | egrep -o '{.+}' | json -gac 'this.userIdentity && this.userIdentity.accessKeyId == "<UR_KEY>"')

NEXT=""
TOKEN=""
COUNT=0
while [ -n "$TOKEN" ] || [ $COUNT -eq 0 ]; do
  test -n "$TOKEN" && NEXT="--next-token '$TOKEN'"
  aws cloudtrail --profile stagebloc --region us-east-1 lookup-events --max-results 10 $NEXT --output text \
    | tee >(cat - >&3) \
    | head -n1 | read TOKEN;

  COUNT=$(($COUNT + 1))
  sleep 0.8
done

exec 3>&-