Status: IN
CloudTrail Lake uses SQL syntax with dot-notation for nested fields (e.g., `userIdentity.arn`) and queries run against event data stores identified by their ARN-derived ID.
Source: entries/2026/03/12/awscloudtrail-latest-userguide-query-create-edit-queryhtml.md