AWS 自定義 Input Transformer 輸出 CloudTrail Event 通知小記
上次的文章, 寫到使用 AWS CloudWatch 通知 IAM 如果新增使用者就透過 SNS 來通知
但是如果收到通知, 信件的內容長的像下列這樣
{"version":"0","id":"baf019d3-e9ce-73cf-8248-342029a1c773","detail-type":"AWS API Call via CloudTrail","source":"aws.iam","account":"838212984580","time":"2021-06-30T07:45:33Z","region":"us-east-1","resources":[],"detail":{"eventVersion":"1.08","userIdentity":{"type":"IAMUser","principalId":"AIDAIRJWANII4AJY47KV4","arn":"arn:aws:iam::938212984580:user/sakana","accountId":"847212984580","accessKeyId":"ASIA4K7LPAMDNYEVZOBN","userName":"sakana","sessionContext":{"sessionIssuer":{},"webIdFederationData":{},"attributes":{"creationDate":"2021-06-30T04:10:47Z","mfaAuthenticated":"true"}}},"eventTime":"2021-06-30T07:45:33Z","eventSource":"iam.amazonaws.com","eventName":"CreateUser","awsRegion":"us-east-1","sourceIPAddress":"xxx.32.yy.195","userAgent":"console.amazonaws.com","requestParameters":{"userName":"demouser","tags":[]},"responseElements":{"user":{"path":"/","userName":"demouser","userId":"AEDA4K7LPAMCPHPLSOBYA","arn":"arn:aws:iam::843212934570:user/demouser","createDate":"Jun 30, 2021 7:45:33 AM"}},"requestID":"5b86b4d1-c23b-48b0-9de3-f33803aefe96","eventID":"322fea0c-93ac-43f3-9786-a596fe121a6a","readOnly":false,"eventType":"AwsApiCall","managementEvent":true,"recipientAccountId":"838212984581","eventCategory":"Management"}}
雖然收到信會知道 IAM 有變動, 但是還是不好閱讀, 想要在收到信的時候, 可以快速的掌握狀況, 上述標示顏色的部份, 就是想要整理出來的資訊.
請教了 Partner , 得到了解法, 在此小記下來
首先可以到 AWS CloudTrail 的 Event history 觀察相關資訊
對應自己收到的資訊, 之後想要顯示
userIdentity 下的
accountId
userName
eventName
awsRegion
sourceIPAddress
responseElements 下 user 下的 userName
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "BIDAJ6LK4OH4WD54F3P5U",
"arn": "arn:aws:iam::732126821902:user/sakana",
"accountId": "783127531104",
"accessKeyId": "ASBA2MGTTSNQFXSELCEQ",
"userName": "sakana",
"sessionContext": {
"sessionIssuer": {},
"webIdFederationData": {},
"attributes": {
"mfaAuthenticated": "true",
"creationDate": "2021-07-14T14:17:37Z"
}
}
},
"eventTime": "2021-07-14T14:49:32Z",
"eventSource": "iam.amazonaws.com",
"eventName": "CreateUser",
"awsRegion": "us-east-1",
"sourceIPAddress": "210.85.244.27",
"userAgent": "console.amazonaws.com",
"requestParameters": {
"userName": "test2021071401",
"tags": []
},
"responseElements": {
"user": {
"path": "/",
"userName": "test2021071401",
"userId": "AIDA3MGTTTNQMPPHXXTVQ",
"arn": "arn:aws:iam::782127831904:user/test2021071401",
"createDate": "Jul 14, 2021 2:49:32 PM"
}
},
"requestID": "7ea3d0b0-4071-4faf-b8e5-afff56ff443d",
"eventID": "849d37e2-1235-46bc-8398-2b3eda5c325c",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"eventCategory": "Management",
"recipientAccountId": "683125831904"
}
作法是開啟 AWS 的 CloudWatch, Region: Virginia ( 之前的 Events Rule 設定在這邊 )
可以編輯之前建立的 Rule ( 或是之後新建 Rule 的時候設定進去 )
Targets 我們之前是使用 SNS topic, 在 Configure input 的部份
將預設的 Matched event 改為 Input Transformer
Input Transformer 總共有 2 個欄位
Input Path
定義要取得的 Key-value 變數
Input Template
要顯示的內容
在 Input Path 的部份, 記得要在前面加上 $.detail
以下是 Input Path 此次設定的範例
{"AccountID":"$.detail.userIdentity.accountId","Staff-userName":"$.detail.userIdentity.userName","sourceIPAddress":"$.detail.sourceIPAddress","eventTime":"$.detail.eventTime","Region":"$.detail.awsRegion","eventName":"$.detail.eventName","Target-userName":"$.detail.responseElements.user.userName"}
取出 userIdentity.accountId 定義為 AccountID
取出 userIdentity.userName 定義為 Staff-userName
取出 sourceIPAddress 定義為 sourceIPAddress
取出 eventTime 定義為 eventTime
取出 awsRegion 定義為 Region
取出 eventName 定義為 eventName
取出 responseElements.user.userName 定義為 Target-userName
以上請先觀察你的 Cloudwatch Event history 相關資訊
接下來是 Input Template, 這個就比較簡單了, 就是通知的信件內容
以下為此次設定的範例
"這是來自雲端課的通知，偵測到Assume Role行為"
"AccountID: <AccountID>"
"Region:<Region>"
"同仁帳號: <Staff-userName>"
"EventTime: <eventTime>"
"SourceIP: <sourceIPAddress>"
"EventName: <eventName>"
"目標帳號名稱: <Target-userName>"
接下來就是收到信的範例
"這是來自雲端課的通知，偵測到Assume Role行為"
"AccountID: 762327821902"
"Region:us-east-1"
"建立者: sakana"
"EventTime: 2021-07-14T15:22:28Z"
"SourceIP: 210.59.244.94"
"EventName: CreateUser"
"目標帳號名稱: test2021071403"
又前進一步了
~ enjoy it
Reference
http://sakananote2.blogspot.com/2020/02/aws-cloudwatch-iam.html
ECV Partner 的大力幫忙
