How do I use CloudTrail LookupEvents to find the source of "Rate exceeded" errors associated with Lambda function management event API calls?
I want to use Amazon CloudTrail LookupEvents to find the source of errors caused by exceeding AWS Lambda function quotas limits.
"I want to use Amazon CloudTrail LookupEvents to find the source of errors caused by exceeding AWS Lambda function quotas limits.ResolutionYou might receive a "Rate exceeded" error when your environment exceeds Lambda function quota limits for API requests. Before you resolve a "Rate exceeded" error, review your CloudTrail event logs.1.    Run the CloudTrail lookup-events AWS Command Line Interface (AWS CLI) command to view the total count of management event API calls.Note: Set the start-time, end-time, and time zone for each value to match the problematic timeframe.aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=lambda.amazonaws.com --start-time YYYY-MM-DDTHH:MM:SS+00:00 --end-time YYYY-MM-DDTHH:MM:SS+00:00 | grep -i EventName | grep -v CloudTrailEvent | sort | uniq -c | sort -rNote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Example CloudTrail lookup-events AWS CLI command:aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=lambda.amazonaws.com --start-time 2023-04-03T18:29:00+05:30 --end-time 2023-04-03T18:29:30+05:30 | grep -i EventName | grep -v CloudTrailEvent | sort | uniq -c | sort -rExample CloudTrail lookup-events AWS CLI command output:2072    "EventName": "ListVersionsByFunction20150331", 877    "EventName": "GetFunction20150331v2", 245    "EventName": "GetFunctionCodeSigningConfig", 210    "EventName": "UpdateFunctionCode20150331v2", 210    "EventName": "ListTags20170331", 206    "EventName": "GetRuntimeManagementConfig", 121    "EventName": "PublishVersion20150331", 106    "EventName": "UpdateAlias20150331", 89     "EventName": "GetPolicy20150331v2",  2     "EventName": "ListLayers20181031",2.    Run the CloudTrail lookup-events command to view the total count of API calls that each user made.Note: Set the start-time, end-time, and time zone for each value to match the problematic timeframe.aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=lambda.amazonaws.com --start-time YYYY-MM-DDTHH:MM:SS+00:00 --end-time YYYY-MM-DDTHH:MM:SS+00:00 | grep -i Username | grep -v CloudTrailEvent | sort | uniq -c |. sort -rExample CloudTrail lookup-events AWS CLI command:aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=lambda.amazonaws.com --start-time 2023-04-03T18:29:00+05:30 --end-time 2023-04-03T18:29:30+05:30 | grep -i Username | grep -v CloudTrailEvent | sort | uniq -c | sort -rExample CloudTrail lookup-events AWS CLI command output:4047   "Username": "AWSCloudFormation", 89    "Username": "auditor",  2    "Username": "appsync",3.    If necessary, run the CloudTrail lookup-events command again to identify users or events that might be making a high number of API calls.4.    After you review the output of the CloudTrail lookup-events command, review the source of the API calls that exceed the Lambda function quota limits.Related informationHow do I prevent "Rate exceeded" errors in CloudFormation?How do I troubleshoot Lambda function throttling with "Rate exceeded" and 429 "TooManyRequestsException" errors?Follow"