# CloudWatch Logs Insights: Bedrock API key usage by principal.
# Recommended alarm: result count > 100/hour (tune to your baseline).
#
# CloudTrail-to-CWLogs serialises callWithBearerToken as the string "true",
# not a native boolean. The filter quotes the value accordingly.

fields @timestamp, userIdentity.principalId, sourceIPAddress, eventName, userAgent
| filter additionalEventData.callWithBearerToken = "true"
| stats count() by eventName, userIdentity.principalId
| sort count desc
