Strip live AKIA/ASIA accessKeyId, STS sessionToken in responseElements, 12-digit AWS account IDs, and sourceIPAddress 100% in local browser RAM — bypassing jq stringified-JSON traps and GitHub GH013 secret blocks.
Process and sanitize Cloudtrailshield payloads 100% privately inside browser memory
Drop Local File Here or Click to Browse
Supports CSV, JSON, TXT, XML & Log Streams
jq '(.Records[]? // .) |= (if .userIdentity.accessKeyId then .userIdentity.accessKeyId = "AKIA_REDACTED" else . end | if .responseElements.credentials.sessionToken then .responseElements.credentials.sessionToken = "[REDACTED_STS]" else . end)' cloudtrail.json⚠️ Why Naive CLI / Regex Fails: Fails when CloudTrail events come from aws cloudtrail lookup-events where the inner CloudTrailEvent field is a double-escaped JSON string, leaving AKIA/ASIA keys, 12-digit account IDs, and S3 presigned query parameters completely exposed.
🛡️ Pre-LLM & Ticket Safety: How to sanitize AWS CloudTrail JSON logs (userIdentity, requestParameters, responseElements) before pasting into ChatGPT, Claude, or Cursor
Core capabilities built into CloudTrailShield
Unlike flat jq pipelines that skip the escaped CloudTrailEvent string returned by AWS CLI lookup-events, our engine recursively sanitizes nested IAM policy JSON and STS credentials.
Replaces 20-char AKIA/ASIA keys and temporary STS sessionTokens with format-valid placeholders that pass GitHub GH013 and Gitleaks.
Deterministically masks 12-digit AWS account numbers across userIdentity.arn, resources[].ARN, and recipientAccountId while preserving cross-account relationship topology.
Investigate compromised IAM roles and S3 data events with LLMs without ever uploading sensitive CloudTrail audit trails to external SaaS servers.
Zero configuration, zero cloud server dependencies, instant execution.
See why merchants and prosumers switch from monthly subscriptions to our local buyout.
| Feature / Metric | 🛡️ CloudTrailShield | ☁️ Cloud SaaS (Panther) |
|---|---|---|
| Data Egress & Execution Architecture | 🛡️ 100% Client-Side Browser RAM (Zero Server Upload) | ☁️ Cloud SIEM Ingestion ($49/mo+ & S3 bucket forwarding) |
| aws cloudtrail lookup-events Stringified JSON Support | 🛡️ Recursive Inner CloudTrailEvent String & Object Scrubbing | ☁️ Flat jq scripts miss keys inside escaped JSON strings |
| STS AssumeRole responseElements.credentials Masking | 🛡️ Automatic FwoGZX... sessionToken & AccessKeyId Stripping | ☁️ Manual scrubbing before committing Sigma test fixtures |
| 12-Digit AWS Account ID & ARN Prefix Preservation | 🛡️ Preserves arn:aws:iam/sts/s3 Structure with Masked Account ID | ☁️ Destroys ARN syntax needed by SIEM detection parsers |
Eliminate vendor lock-in and cloud upload security risks.
Why pay monthly recurring SaaS fees for simple aws cloudtrail tools? Switch to CloudTrailShield for a single $19 buyout.
Panther uploads private data to cloud servers. We process 100% locally on your machine.
Process large aws cloudtrail files instantly without waiting for cloud server roundtrips.
Deep technical breakdown driving our client-side productivity engine.
Processes CloudTrailShield structures directly inside isolated browser memory.
Ensures zero CloudTrailShield bytes touch external API servers or third-party storage.
Parses high-throughput CloudTrailShield records in real-time with sub-millisecond response times.
Full compliance with international privacy mandates through total data sovereignty.
No monthly bills. No sneaky price hikes. Pay once, use forever.
Live Local Studio Preview
Prosumer & Solo Professional
One-Off Emergency Unlock & Trial
Everything you need to know about privacy, local memory execution, and buyouts.
Drop your CloudTrail Records[] JSON or aws cloudtrail lookup-events export into CloudTrailShield. It scrubs AKIA/ASIA access keys, STS sessionTokens, 12-digit AWS account IDs, and SSO emails 100% in local browser RAM.
Unlike S3 log files where Records[] contains native JSON objects, aws cloudtrail lookup-events wraps each event inside a stringified CloudTrailEvent JSON field. Standard jq path selectors skip stringified fields, leaving AKIA/ASIA keys exposed.
Yes. CloudTrailShield keeps all eventVersion, eventSource, eventName, and ARN structural formatting intact while replacing real AKIA/ASIA tokens and 12-digit account IDs so GitHub GH013 and Gitleaks never block your detection-as-code commits.
Yes. It scans userIdentity.arn, userIdentity.accountId, recipientAccountId, and roleArn strings inside requestParameters, replacing 12-digit account IDs while keeping service and role syntax valid.
Panther is a cloud-hosted SIEM for continuous ingestion, whereas CloudTrailShield ($19 one-time buyout) is a zero-egress client-side appliance built to sanitize raw CloudTrail JSON before pasting into LLMs, Jira tickets, or Git repos.