cloudtrail validate-logs will spend a long time doing nothing if log files do not exist for the date range

[lfdebrux]

If I put the date for start time and end time in the future then aws cloudtrail validate-logs will spend a long time listing objects in the bucket.

What I run:

time aws cloudtrail validate-logs --region=eu-west-1 --trail-arn="arn:aws:cloudtrail:eu-west-1:<account_id>:trail/<trail_name>" --start-time=2525-01-01T0900 --end-time=2525-01-01T1000 --debug

What I expect:

Validating log files for trail arn:aws:cloudtrail:eu-west-1:<account_id>:trail/<trail_name> between 2525-01-01T09:00:00Z and 2525-01-01T10:00:00Z

Results requested for 2525-01-01T09:00:00Z to 2525-01-01T10:00:00Z
No digests found
        2.03 real         0.57 user         0.12 sys

If I try to validate logs for a time before CloudTrail being enabled, it takes about 2 seconds to recognise that there are no log files available.

What I get:

Validating log files for trail arn:aws:cloudtrail:eu-west-1:<account_id>:trail/<trail_name> between 2525-01-01T09:00:00Z and 2525-01-01T10:00:00Z

An error occurred (InvalidTimeRangeException) when calling the ListPublicKeys operation: Invalid input parameter! Start time is after current time
       55.88 real        10.87 user         1.05 sys

Notice that this takes almost a minute real time, this is a lot longer than I would expect.

Running the command with --debug shows that the process spends a long time sending a lot of ListObjects requests.

[kyleknap]

Thanks for the deep dive here. Looking over the code, I can confirm it will spend the time listing the objects in the buckets. The validation error is coming from CloudTrail. An easy fix would be to just switch these lines but we should confirm it does not have any unintentional side effects.