from logs-aws.cloudtrail-* metadata _id, _version, _index
| where
  event.provider == "ec2.amazonaws.com"
  and event.action == "ModifySnapshotAttribute"
  and event.outcome == "success"

// Extract snapshotId, attribute type, operation type, and userId
| dissect aws.cloudtrail.request_parameters
  "{%{?snapshotId}=%{Esql.aws_cloudtrail_request_parameters_snapshot_id},%{?attributeType}=%{Esql.aws_cloudtrail_request_parameters_attribute_type},%{?createVolumePermission}={%{Esql.aws_cloudtrail_request_parameters_operation_type}={%{?items}=[{%{?userId}=%{Esql_priv.aws_cloudtrail_request_parameters_user_id}}]}}}"

// Check for snapshot permission added for another AWS account
| where
  Esql.aws_cloudtrail_request_parameters_operation_type == "add"
  and cloud.account.id != Esql_priv.aws_cloudtrail_request_parameters_user_id

// keep ECS and derived fields
| keep
  @timestamp,
  aws.cloudtrail.user_identity.arn,
  cloud.account.id,
  event.action,
  Esql.aws_cloudtrail_request_parameters_snapshot_id,
  Esql.aws_cloudtrail_request_parameters_attribute_type,
  Esql.aws_cloudtrail_request_parameters_operation_type,
  Esql_priv.aws_cloudtrail_request_parameters_user_id,
  source.ip