There has been a user that turned on Q (probably to test it).
Amazon has since been incurring 250 a month (even when no pro-users were active any longer (sic!)).
Is there a way I can e.g. query cloudtrail logs to find out who turned it on? What query do I need to use?
Hello Bart,
I am not very sure about the cloud trail log but if an Author creates a topic on the data set then also Q subscription gets activated.
you may check if there any topics that were created and who owns that.
In order to deactivate Q, you would need to change pro users to normal user such as Author or Reader and delate/remove any topic that exist. (Assuming - Amazon Q)
Hope this helps.
Cheers,
Deep
Hi Deep,
Not really, yet. I need to check what happened in the past. It even worries me that any author can start an action that will result in charges of 250 each month.
Bart
Hello Bart,
Well in addition you surely may check the cloud trail log to find out the event
CloudTrail > Event history and look for below
Event Source - quicksight.amazonaws.com
Event name - CreateTopic
Most likely the user may be in long id rather then the friendly name but you may match the id and friendly name with describe-user api call
Hope this helps.
Cheers,
Deep
Hi Deep,
That was a very good idea!
Unfortunately, still not helpful in my case since the first topic was created end of August while our bills started in May.
In cost explorer I can see that in May a Reader Pro Subscription started, however, role switches do not seem to be logged in CloudTrail.
Cheers,
Bart.
Hi @BFJonk,
It’s been awhile since last activity on this thread, did you have any additional questions regarding your initial post?
If we do not hear back within the next 3 business days, I’ll go ahead and close out this topic.
Thank you!
In the end I found out based on the daily download that we do on QuickSight configuration, that we store in GIT.
I’m planing to open source the software used for this. And would like to use this post to put a link to the open sourced package.