Query: root_user_activity_report_table

select
  epoch_ms(tp_timestamp) as timestamp,
  string_split(event_source, '.')[1] || ':' || event_name as operation,
  user_identity.arn as actor,
  tp_source_ip as source_ip,
  tp_index::varchar as account_id,
  aws_region as region,
  tp_id as source_id,
  *
from
  aws_cloudtrail_log
where
  ($1 = 'true' or ($1 = 'false' and read_only = false))
  and recipient_account_id in $2
  and user_identity.type = 'Root'
order by
  timestamp desc
limit 10000;