使用 Amazon CloudTrail 记录 Amazon CloudWatch API 和控制台操作
Amazon CloudWatch 和 CloudWatch Synthetics 与 Amazon CloudTrail 集成，后者是一种提供用户、角色或 Amazon 服务所采取操作的记录的服务。CloudTrail 捕获由您的 Amazon 账户发出或代表该账户发出的 API 调用。捕获的调用包含来自控制台的调用和对 API 操作的代码调用。
如果您创建了一个跟踪记录，则可以使 CloudTrail 事件持续传送到 Amazon S3 存储桶（包括 CloudWatch 的事件）。如果您不配置跟踪，则仍可在 CloudTrail 控制台中的 事件历史记录 中查看最新事件。使用 CloudTrail 收集的信息，您可以确定向 CloudWatch 发出的请求内容、发出请求的 IP 地址、何人发出的请求、请求的发出时间以及其他详细信息。
要了解有关 CloudTrail 的更多信息（包括如何对其进行配置和启用），请参阅 Amazon CloudTrail 用户指南。
每个事件或日记账条目都包含有关生成请求的人员信息。身份信息可帮助您确定以下内容：
-
请求是使用根用户凭证还是 Amazon Identity and Access Management（IAM）用户凭证发出的。
-
请求是使用角色还是联合用户的临时安全凭证发出的。
-
请求是否由其它 Amazon 服务发出。
有关更多信息，请参阅 CloudTrail userIdentity 元素。
要持续记录 Amazon 账户中的事件（包括 CloudWatch 和 CloudWatch Synthetics 的事件），请创建跟踪记录。通过跟踪，CloudTrail 可将日志文件传送至 S3 存储桶。默认情况下，在控制台中创建跟踪时，此跟踪应用于所有 Amazon 区域。此跟踪在 Amazon 分区中记录所有区域中的事件，并将日志文件传送至您指定的 S3 存储桶。您可以配置其他 Amazon 服务，进一步分析在 CloudTrail 日志中收集的事件数据并采取措施。有关更多信息，请参阅下列内容：
注意
有关 CloudTrail 中记录的 CloudWatch Logs API 调用的信息，请参阅 CloudTrail 中的 CloudWatch Logs 信息。
主题
CloudTrail 中的 CloudWatch 信息
CloudWatch 支持将以下操作记录为 CloudTrail 日志文件中的事件：
示例：CloudWatch 日志文件条目
下面的示例显示了一个 CloudTrail 日志条目，该条目演示了 PutMetricAlarm 操作。
{ "Records": [{ "eventVersion": "1.01", "userIdentity": { "type": "Root", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::123456789012:root", "accountId": "123456789012", "accessKeyId": "EXAMPLE_KEY_ID" }, "eventTime": "2014-03-23T21:50:34Z", "eventSource": "monitoring.amazonaws.com", "eventName": "PutMetricAlarm", "awsRegion": "us-east-1", "sourceIPAddress": "127.0.0.1", "userAgent": "aws-sdk-ruby2/2.0.0.rc4 ruby/1.9.3 x86_64-linux Seahorse/0.1.0", "requestParameters": { "threshold": 50.0, "period": 60, "metricName": "CloudTrail Test", "evaluationPeriods": 3, "comparisonOperator": "GreaterThanThreshold", "namespace": "AWS/CloudWatch", "alarmName": "CloudTrail Test Alarm", "statistic": "Sum" }, "responseElements": null, "requestID": "29184022-b2d5-11e3-a63d-9b463e6d0ff0", "eventID": "b096d5b7-dcf2-4399-998b-5a53eca76a27" }, ..additional entries ] }
以下日志文件条目显示某个用户调用了 CloudWatch Events PutRule 操作。
{ "eventVersion":"1.03", "userIdentity":{ "type":"Root", "principalId":"123456789012", "arn":"arn:aws:iam::123456789012:root", "accountId":"123456789012", "accessKeyId":"AKIAIOSFODNN7EXAMPLE", "sessionContext":{ "attributes":{ "mfaAuthenticated":"false", "creationDate":"2015-11-17T23:56:15Z" } } }, "eventTime":"2015-11-18T00:11:28Z", "eventSource":"events.amazonaws.com", "eventName":"PutRule", "awsRegion":"us-east-1", "sourceIPAddress":"AWS Internal", "userAgent":"AWS CloudWatch Console", "requestParameters":{ "description":"", "name":"cttest2", "state":"ENABLED", "eventPattern":"{\"source\":[\"aws.ec2\"],\"detail-type\":[\"EC2 Instance State-change Notification\"]}", "scheduleExpression":"" }, "responseElements":{ "ruleArn":"arn:aws:events:us-east-1:123456789012:rule/cttest2" }, "requestID":"e9caf887-8d88-11e5-a331-3332aa445952", "eventID":"49d14f36-6450-44a5-a501-b0fdcdfaeb98", "eventType":"AwsApiCall", "apiVersion":"2015-10-07", "recipientAccountId":"123456789012" }
以下日志文件条目显示某个用户调用了 CloudWatch Logs CreateExportTask 操作。
{ "eventVersion": "1.03", "userIdentity": { "type": "IAMUser", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::123456789012:user/someuser", "accountId": "123456789012", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName": "someuser" }, "eventTime": "2016-02-08T06:35:14Z", "eventSource": "logs.amazonaws.com", "eventName": "CreateExportTask", "awsRegion": "us-east-1", "sourceIPAddress": "127.0.0.1", "userAgent": "aws-sdk-ruby2/2.0.0.rc4 ruby/1.9.3 x86_64-linux Seahorse/0.1.0", "requestParameters": { "destination": "yourdestination", "logGroupName": "yourloggroup", "to": 123456789012, "from": 0, "taskName": "yourtask" }, "responseElements": { "taskId": "15e5e534-9548-44ab-a221-64d9d2b27b9b" }, "requestID": "1cd74c1c-ce2e-12e6-99a9-8dbb26bd06c9", "eventID": "fd072859-bd7c-4865-9e76-8e364e89307c", "eventType": "AwsApiCall", "apiVersion": "20140328", "recipientAccountId": "123456789012" }
CloudTrail 中的 CloudWatch 数据面板事件
CloudTrail 可以捕获与 CloudWatch 数据面板操作 GetMetricData 和 GetMetricWidgetImage 相关的 API 活动。
数据事件也称为数据面板操作，可让您深入了解在资源上或资源内执行的资源操作。数据事件通常是高容量活动。
要在 CloudTrail 文件中启用 GetMetricData 和 GetMetricWidgetImage 数据事件的日志记录，需要在 CloudTrail 中启用数据面板 API 活动的日志记录。有关更多信息，请参阅记录数据事件用于跟踪。
可以按资源类型筛选数据面板事件。由于在 CloudTrail 中使用数据事件会产生额外费用，因此按资源筛选可以让您更好地控制自己记录和支付费用的内容。
使用 CloudTrail 收集的信息，可以确定向 CloudWatch GetMetricData 或 GetMetricWidgetImage API 发出的特定请求、请求者的 IP 地址、请求者的身份以及请求的日期和时间。使用 CloudTrail 记录 GetMetricData 和 GetMetricWidgetImage API 可帮助您实现 Amazon 账户的运营和风险审计、治理与合规性。
注意
当您在 CloudTrail 中查看 GetMetricData 事件时，可能会看到比您发起的调用更多的调用。这是因为 CloudWatch 将由内部组件发起的 GetMetricData 操作的事件记录到 CloudTrail。例如，在跨账户可观测性中，您将看到 CloudWatch 控制面板发起 GetMetricData 调用以刷新小组件数据，而监控账户发起 GetMetricData 调用以从源账户检索数据。这些内部发起的调用不会产生 CloudWatch 费用，但会计入 CloudTrail 中记录的事件数量，而 CloudTrail 根据记录的事件数量收费。
以下是 GetMetricData 操作的 CloudTrail 事件示例。
{ "eventVersion": "1.09", "userIdentity": { "type": "IAMUser", "principalId": "AIDA2NYTR2EPCTNY7AF3L", "arn": "arn:aws:iam::111122223333:user/admin", "accountId": "111122223333", "accessKeyId": "EXAMPLE1234567890", "userName": "admin" }, "eventTime": "2024-05-08T16:20:34Z", "eventSource": "monitoring.amazonaws.com", "eventName": "GetMetricData", "awsRegion": "us-east-1", "sourceIPAddress": "99.45.3.7", "userAgent": "aws-cli/2.13.23 Python/3.11.5 Darwin/23.4.0 exe/x86_64 prompt/off command/cloudwatch.get-metric-data", "requestParameters": { "metricDataQueries": [{ "id": "e1", "expression": "m1 / m2", "label": "ErrorRate" }, { "id": "m1", "metricStat": { "metric": { "namespace": "CWAgent", "metricName": "disk_used_percent", "dimensions": [{ "name": "LoadBalancerName", "value": "EXAMPLE4623a5cb6a7384c5229" }] }, "period": 300, "stat": "Sum", "unit": "Count" }, "returnData": false }, { "id": "m2", "metricStat": { "metric": { "namespace": "CWAgent", "metricName": "disk_used_percent", "dimensions": [{ "name": "LoadBalancerName", "value": "EXAMPLE4623a5cb6a7384c5229" }] }, "period": 300, "stat": "Sum" }, "returnData": true } ], "startTime": "Apr 19, 2024, 4:00:00 AM", "endTime": "May 8, 2024, 4:30:00 AM" }, "responseElements": null, "requestID": "EXAMPLE-57ac-47d5-938c-f5917c6799d5", "eventID": "EXAMPLE-211c-404b-b13d-36d93c8b4fbf", "readOnly": true, "resources": [{ "type": "AWS::CloudWatch::Metric" }], "eventType": "AwsApiCall", "managementEvent": false, "recipientAccountId": "111122223333", "eventCategory": "Data", "tlsDetails": { "tlsVersion": "TLSv1.3", "cipherSuite": "TLS_AES_128_GCM_SHA256", "clientProvidedHostHeader": "monitoring.us-east-1.amazonaws.com" } }
CloudTrail 中的查询生成信息
还支持查询生成器控制台事件的 CloudTrail 日志记录。查询生成器目前支持 CloudWatch Metric Insights 和 CloudWatch Logs Insights。在这些 CloudTrail 事件中，eventSource 为 monitoring.amazonaws.com。
以下示例显示了一个 CloudTrail 日志条目，该条目演示了 CloudWatch Metrics Insights 中的 GenerateQuery 操作。
{ "eventVersion": "1.09", "userIdentity": { "type": "AssumedRole", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::123456789012:assumed-role/role_name", "accountId": "123456789012", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "sessionContext": { "sessionIssuer": { "type": "Role", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::111222333444:role/Administrator", "accountId": "123456789012", "userName": "SAMPLE_NAME" }, "attributes": { "creationDate": "2020-04-08T21:43:24Z", "mfaAuthenticated": "false" } } }, "eventTime": "2020-04-08T23:06:30Z", "eventSource": "monitoring.amazonaws.com", "eventName": "GenerateQuery", "awsRegion": "us-east-1", "sourceIPAddress": "127.0.0.1", "userAgent": "exampleUserAgent", "requestParameters": { "query_ask": "***", "query_type": "MetricsInsights", "metrics_insights": { "aws_namespaces": [ "AWS/S3", "AWS/Lambda", "AWS/DynamoDB" ] }, "include_description": true }, "responseElements": null, "requestID": "2f56318c-cfbd-4b60-9d93-1234567890", "eventID": "52723fd9-4a54-478c-ac55-1234567890", "readOnly": true, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111122223333", "eventCategory": "Management" }
CloudTrail 中的 CloudWatch Internet Monitor
CloudWatch 互联网监测仪支持将以下操作记录为 CloudTrail 日志文件中的事件。
示例：CloudWatch Internet Monitor 日志文件条目
以下示例显示了一个 CloudTrail Internet Monitor 日志条目，该条目演示了 ListMonitors 操作。
{ "eventVersion": "1.08", "userIdentity": { "type": "AssumedRole", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::000000000000:assumed-role/role_name", "accountId":"123456789012", "accessKeyId":"AKIAIOSFODNN7EXAMPLE", "sessionContext": { "sessionIssuer": { "type": "Role", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::000000000000:role/Admin", "accountId":"123456789012", "userName": "SAMPLE_NAME" }, "webIdFederationData": {}, "attributes": { "creationDate": "2022-10-11T17:25:41Z", "mfaAuthenticated": "false" } } }, "eventTime": "2022-10-11T17:30:18Z", "eventSource": "internetmonitor.amazonaws.com", "eventName": "ListMonitors", "awsRegion": "us-east-2", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)", "requestParameters": null, "responseElements": null, "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111", "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLEbbbbb", "readOnly": true, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111122223333", "eventCategory": "Management" }
以下示例显示了一个 CloudTrail Internet Monitor 日志条目，该条目演示了 CreateMonitor 操作。
{ "eventVersion": "1.08", "userIdentity": { "type": "AssumedRole", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::000000000000:assumed-role/role_name", "accountId":"123456789012", "accessKeyId":"AKIAIOSFODNN7EXAMPLE", "sessionContext": { "sessionIssuer": { "type": "Role", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::000000000000:role/Admin", "accountId":"123456789012", "userName": "SAMPLE_NAME" }, "webIdFederationData": {}, "attributes": { "creationDate": "2022-10-11T17:25:41Z", "mfaAuthenticated": "false" } } }, "eventTime": "2022-10-11T17:30:08Z", "eventSource": "internetmonitor.amazonaws.com", "eventName": "CreateMonitor", "awsRegion": "us-east-2", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)", "requestParameters": { "MonitorName": "TestMonitor", "Resources": ["arn:aws:ec2:us-east-2:444455556666:vpc/vpc-febc0b95"], "ClientToken": "a1b2c3d4-5678-90ab-cdef-EXAMPLE33333" }, "responseElements": { "Arn": "arn:aws:internetmonitor:us-east-2:444455556666:monitor/ct-onboarding-test", "Status": "PENDING" }, "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111", "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLEbbbbb", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "111122223333", "eventCategory": "Management" }
CloudTrail 中的 CloudWatch Synthetics 信息
CloudWatch Synthetics 支持在 CloudTrail 日志文件中将以下操作记录为事件：
示例：CloudWatch Synthetics 日志文件条目
下面的示例显示了一个 CloudTrail Synthetics 日志条目，该条目说明了 DescribeCanaries 操作。
{ "eventVersion": "1.05", "userIdentity": { "type": "AssumedRole", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::123456789012:assumed-role/role_name", "accountId":"123456789012", "accessKeyId":"AKIAIOSFODNN7EXAMPLE", "sessionContext": { "sessionIssuer": { "type": "Role", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::111222333444:role/Administrator", "accountId":"123456789012", "userName": "SAMPLE_NAME" }, "webIdFederationData": {}, "attributes": { "mfaAuthenticated": "false", "creationDate": "2020-04-08T21:43:24Z" } } }, "eventTime": "2020-04-08T23:06:47Z", "eventSource": "synthetics.amazonaws.com", "eventName": "DescribeCanaries", "awsRegion": "us-east-1", "sourceIPAddress": "127.0.0.1", "userAgent": "aws-internal/3 aws-sdk-java/1.11.590 Linux/4.9.184-0.1.ac.235.83.329.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.212-b03 java/1.8.0_212 vendor/Oracle_Corporation", "requestParameters": null, "responseElements": null, "requestID": "201ed5f3-15db-4f87-94a4-123456789", "eventID": "73ddbd81-3dd0-4ada-b246-123456789", "readOnly": true, "eventType": "AwsApiCall", "recipientAccountId": "111122223333" }
下面的示例显示了一个 CloudTrail Synthetics 日志条目，该条目说明了 UpdateCanary 操作。
{ "eventVersion": "1.05", "userIdentity": { "type": "AssumedRole", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::123456789012:assumed-role/role_name", "accountId":"123456789012", "accessKeyId":"AKIAIOSFODNN7EXAMPLE", "sessionContext": { "sessionIssuer": { "type": "Role", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::111222333444:role/Administrator", "accountId":"123456789012", "userName": "SAMPLE_NAME" }, "webIdFederationData": {}, "attributes": { "mfaAuthenticated": "false", "creationDate": "2020-04-08T21:43:24Z" } } }, "eventTime": "2020-04-08T23:06:47Z", "eventSource": "synthetics.amazonaws.com", "eventName": "UpdateCanary", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "aws-internal/3 aws-sdk-java/1.11.590 Linux/4.9.184-0.1.ac.235.83.329.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.212-b03 java/1.8.0_212 vendor/Oracle_Corporation", "requestParameters": { "Schedule": { "Expression": "rate(1 minute)" }, "name": "sample_canary_name", "Code": { "Handler": "myOwnScript.handler", "ZipFile": "SAMPLE_ZIP_FILE" } }, "responseElements": null, "requestID": "fe4759b0-0849-4e0e-be71-1234567890", "eventID": "9dc60c83-c3c8-4fa5-bd02-1234567890", "readOnly": false, "eventType": "AwsApiCall", "recipientAccountId": "111122223333" }
下面的示例显示了一个 CloudTrail Synthetics 日志条目，该条目说明了 GetCanaryRuns 操作。
{ "eventVersion": "1.05", "userIdentity": { "type": "AssumedRole", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::123456789012:assumed-role/role_name", "accountId":"123456789012", "accessKeyId":"AKIAIOSFODNN7EXAMPLE", "sessionContext": { "sessionIssuer": { "type": "Role", "principalId": "EX_PRINCIPAL_ID", "arn": "arn:aws:iam::111222333444:role/Administrator", "accountId":"123456789012", "userName": "SAMPLE_NAME" }, "webIdFederationData": {}, "attributes": { "mfaAuthenticated": "false", "creationDate": "2020-04-08T21:43:24Z" } } }, "eventTime": "2020-04-08T23:06:30Z", "eventSource": "synthetics.amazonaws.com", "eventName": "GetCanaryRuns", "awsRegion": "us-east-1", "sourceIPAddress": "127.0.0.1", "userAgent": "aws-internal/3 aws-sdk-java/1.11.590 Linux/4.9.184-0.1.ac.235.83.329.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.212-b03 java/1.8.0_212 vendor/Oracle_Corporation", "requestParameters": { "Filter": "TIME_RANGE", "name": "sample_canary_name", "FilterValues": [ "2020-04-08T23:00:00.000Z", "2020-04-08T23:10:00.000Z" ] }, "responseElements": null, "requestID": "2f56318c-cfbd-4b60-9d93-1234567890", "eventID": "52723fd9-4a54-478c-ac55-1234567890", "readOnly": true, "eventType": "AwsApiCall", "recipientAccountId": "111122223333" }