S3.amazonaws.com

 select userIdentity.arn as user,
   element_at(requestParameters, 'bucketName') as bucket,
   element_at(requestParameters, 'key') as key,
   count(*) as attempts
from xxxxx-yyyyy-xxxxx-zzzz-xxxxx
where eventSource = 's3.amazonaws.com'
   and eventName = 'GetObject'
   and userIdentity.arn = 'arn:aws:sts::0987654321:assumed-role/your-role/[email protected]'
group by 1,
   2,
   3
order by attempts desc

See also

• AWS CloudTrail, AWS CloudTrail Insights, CloudTrail Events, AWS CloudTrail Lake, Terraform, Best practices, Datadog SIEM Content Packs for Cloudtrail