An organization has a SAML 2.0-compliant corporate identity provider (IdP) that is federated with AWS IAM. Users from the corporate IdP can use the AWS management console. A security engineer has been asked to identify which federated user terminated an Amazon EC2 instance a few days ago. What is the FASTEST method of identifying the federated user who terminated the instance?