find the owner of EC2 instance by Athena and CloudTrail
I found the right query to find the owner of an ECS instance. That might help someone!
SELECT DISTINCT eventsource, eventname, useridentity.userName, eventtime, json_extract(responseelements, '$.instancesSet.items[0].instanceId') as instance_id FROM cloudtrail_logsWHERE account = 'xxxxxxx' AND eventname = 'RunInstances'AND responseelements LIKE '%i-3434ecb4c12%' ;