import subprocess
import json
import sys
cmd='aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=RunInstances --max-results 20 --region us-east-1'
cmds=cmd.split(' ')
#cl=subprocess.run(cmds,text=True, capture_output=True)
cl=subprocess.Popen(cmds, stdout=subprocess.PIPE)
lines = cl.stdout.readlines()
#clstr=str(cl)
#lines=clstr.split('\n')
lst=[]
for l in lines:
#    print(l)
    if '"AccessKeyId":' in l:
        lst.append(l)

    if '"EventName":' in l:
        lst.append(l)

print(lst)

#        print(l)
#        sys.exit()
#js=json.loads(str(cl))
#print(js)