aws cloudtrail lookup-events \
--lookup-attributes AttributeKey=EventName,AttributeValue=ModifyVolume \
--start-time "$(date -d '00:00' --iso-8601=seconds)" \
--end-time "$(date -d '23:59' --iso-8601=seconds)" \
--query 'Events[?contains(CloudTrailEvent, `gp3`)]' \
--output json | jq -r '
.[]
| .CloudTrailEvent
| fromjson
| [
.eventTime,
.requestParameters.ModifyVolumeRequest.VolumeId,
.responseElements.ModifyVolumeResponse.volumeModification.originalVolumeType,
.requestParameters.ModifyVolumeRequest.VolumeType
]
| @tsv'
output:
2025-05-29T15:25:42Z vol-0b2b9602bf3275c70 gp2 gp3
2025-05-29T15:25:49Z vol-08403d278904ba5dd gp2 gp3
list volumes with name:
VOLUMES=(
vol-0123456789abcdef0
vol-0fedcba9876543210
vol-0a1b2c3d4e5f6a7b8
vol-09f8e7d6c5b4a3f2e
vol-0555aaaa9999bbbb1
)
for VOL in "${VOLUMES[@]}"; do
INSTANCE_ID=$(aws ec2 describe-volumes \
--volume-ids "$VOL" \
--query 'Volumes[0].Attachments[0].InstanceId' \
--output text)
if [ "$INSTANCE_ID" != "None" ]; then
NAME=$(aws ec2 describe-instances \
--instance-ids "$INSTANCE_ID" \
--query 'Reservations[0].Instances[0].Tags[?Key==`Name`]|[0].Value' \
--output text)
echo -e "$VOL\t$INSTANCE_ID\t$NAME"
else
echo -e "$VOL\t(no instance attached)"
fi
done
output:
VOLUME ID INSTANCE ID INSTANCE NAME
vol-0123456789abcdef0 i-0a1b2c3d4e5f6g7h8 web-prod-1
vol-0fedcba9876543210 i-09f8e7d6c5b4a3f2e db-staging
vol-0a1b2c3d4e5f6a7b8 (no instance attached)