Yeah, in my case, I wasn't familiar with the settings for Cloudtrail Data Events, and didn't realize you could select which events to log, based on the actor or resource, as opposed to all events in DynamoDB. That would have saved me a lot processing power to filter the logs to look for the actions I was looking for.