consider using Cloudwatch filtered metrics or Cloudtrail considerations : https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/MonitoringLogData.html