I've been working on AWS security for years and querying CloudTrail has always been a huge pain - getting data about like "what did this role actually use in the last 30 days?" means either writing custom queries and result parsing code or getting vague data from built-in tools like Access Analyzer.

TrailTool's core idea is to pre-aggregate CloudTrail events at ingest time into entity relationships — People, Sessions, Roles, Services, Resources — so queries are DynamoDB reads rather than log scans. The CLI talks directly to your DynamoDB tables using standard AWS credentials, no API layer needed.

The four workflows in the post (ClickOps detection, least-privilege policy generation, AccessDenied remediation, break-glass validation) all came from things I was actually doing manually. The session transcripts are real Claude Code runs using the tool.

Wondering if this feels useful to folks, or if there are other CloudTrail questions that could be pre-computed this way to accomplish common tasks.