from logs-aws.cloudtrail-* metadata _id, _version, _index

| where
  event.provider == "iam.amazonaws.com"
  and event.action == "AttachGroupPolicy"
  and event.outcome == "success"

// Extract policy and group details from request parameters
| dissect aws.cloudtrail.request_parameters
    "{%{?policyArn}=%{?arn}:%{?aws}:%{?iam}::%{?aws}:%{?policy}/%{Esql.aws_cloudtrail_request_parameters_policy_name},%{?groupName}=%{Esql.aws_cloudtrail_request_parameters_group_name}}"

// Filter for attachment of AdministratorAccess policy
| where Esql.aws_cloudtrail_request_parameters_policy_name == "AdministratorAccess"

// keep ECS and derived fields
| keep
  @timestamp,
  event.provider,
  event.action,
  event.outcome,
  Esql.aws_cloudtrail_request_parameters_policy_name,
  Esql.aws_cloudtrail_request_parameters_group_name