AWS CloudTrail
用户指南 (版本 1.0)
AWS 文档中描述的 AWS 服务或功能可能因区域而异。要查看适用于中国区域的差异,请参阅中国的 AWS 服务入门

AWS 控制台登录事件

CloudTrail 将记录尝试登录 AWS 管理控制台、AWS 开发论坛和 AWS Support 中心的次数。所有 IAM 用户和根用户登录事件,以及所有联合身份用户登录事件,将在 CloudTrail 日志文件中生成记录。

IAM 用户的示例记录

以下记录显示名为 Anaya 的 IAM 用户在未使用多重验证的情况下成功登录了 AWS 管理控制台。

{ "Records":[ { "eventVersion":"1.05", "userIdentity":{ "type":"IAMUser", "principalId":"AIDACKCEVSQ6C2EXAMPLE", "arn":"arn:aws:iam::111122223333:user/anaya", "accountId":"111122223333", "userName":"anaya" }, "eventTime":"2018-08-29T16:24:34Z", "eventSource":"signin.amazonaws.com", "eventName":"ConsoleLogin", "awsRegion":"us-east-2", "sourceIPAddress":"192.0.2.0", "userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:62.0) Gecko/20100101 Firefox/62.0", "requestParameters":null, "responseElements":{ "ConsoleLogin":"Success" }, "additionalEventData":{ "MobileVersion":"No", "LoginTo":"https://console.aws.amazon.com/sns", "MFAUsed":"No" }, "eventID":"3fcfb182-98f8-4744-bd45-10a395ab61cb", "eventType": "AwsConsoleSignin" } ] }

以下记录显示名为 Anaya 的 IAM 用户已使用多重验证 (MFA) 登录到 AWS 管理控制台。

{ "eventVersion": "1.05", "userIdentity": { "type": "IAMUser", "principalId": "AIDACKCEVSQ6C2EXAMPLE", "arn": "arn:aws:iam::111122223333:user/anaya", "accountId": "111122223333", "userName": "anaya" }, "eventTime": "2018-07-24T18:34:07Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "requestParameters": null, "responseElements": { "ConsoleLogin": "Success" }, "additionalEventData": { "LoginTo": "https://console.aws.amazon.com/console/home?state=hashArgs%23&isauthcode=true", "MobileVersion": "No", "MFAUsed": "Yes" }, "eventID": "fed06f42-cb12-4764-8c69-121063dc79b9", "eventType": "AwsConsoleSignIn", "recipientAccountId": "111122223333" }

以下记录显示一个 IAM 用户的不成功登录尝试。

{ "eventVersion": "1.05", "userIdentity": { "type": "IAMUser", "principalId": "AIDACKCEVSQ6C2EXAMPLE", "accountId": "111122223333", "accessKeyId": "", "userName": "anaya" }, "eventTime": "2018-07-24T18:32:11Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "errorMessage": "Failed authentication", "requestParameters": null, "responseElements": { "ConsoleLogin": "Failure" }, "additionalEventData": { "LoginTo": "https://console.aws.amazon.com/console/home?state=hashArgs%23&isauthcode=true", "MobileVersion": "No", "MFAUsed": "Yes" }, "eventID": "d38ce1b3-4575-4cb8-a632-611b8243bfc3", "eventType": "AwsConsoleSignIn", "recipientAccountId": "111122223333" }

以下显示登录过程检查 IAM 用户在登录过程中是否需要多重验证 (MFA)。

{ "eventVersion": "1.05", "userIdentity": { "type": "IAMUser", "principalId": "AIDACKCEVSQ6C2EXAMPLE", "accountId": "111122223333", "accessKeyId": "", "userName": "anaya" }, "eventTime": "2018-07-24T18:33:45Z", "eventSource": "signin.amazonaws.com", "eventName": "CheckMfa", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", "requestParameters": null, "responseElements": { "CheckMfa": "Success" }, "additionalEventData": { "MfaType": "U2F MFA" }, "eventID": "f8ef8fc5-e3e8-4ee1-9d52-2f412ddf17e3", "eventType": "AwsConsoleSignIn", "recipientAccountId": "111122223333" }

根用户的示例记录

以下显示未使用 MFA 的根用户的成功登录事件。

{ "eventVersion": "1.05", "userIdentity": { "type": "Root", "principalId": "AIDACKCEVSQ6C2EXAMPLE", "arn": "arn:aws:iam::111122223333:root", "accountId": "111122223333", "accessKeyId": "" }, "eventTime": "2018-08-29T16:24:34Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:62.0) Gecko/20100101 Firefox/62.0", "requestParameters": null, "responseElements": { "ConsoleLogin": "Success" }, "additionalEventData": { "LoginTo": "https://console.aws.amazon.com/console/home?state=hashArgs%23&isauthcode=true", "MobileVersion": "No", "MFAUsed": "No" }, "eventID": "deb1e1f9-c99b-4612-8e9f-21f93b5d79c0", "eventType": "AwsConsoleSignIn", "recipientAccountId": "111122223333" }

以下显示未使用 MFA 的根用户的失败登录事件。

{ "eventVersion": "1.05", "userIdentity": { "type": "Root", "principalId": "AIDACKCEVSQ6C2EXAMPLE", "arn": "arn:aws:iam::111122223333:root", "accountId": "111122223333", "accessKeyId": "" }, "eventTime": "2018-08-25T18:10:29Z", "eventSource": "signin.amazonaws.com", "eventName": "ConsoleLogin", "awsRegion": "us-east-1", "sourceIPAddress": "192.0.2.0", "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36", "errorMessage": "Failed authentication", "requestParameters": null, "responseElements": { "ConsoleLogin": "Failure" }, "additionalEventData": { "LoginTo": "https://console.aws.amazon.com/console/home?state=hashArgs%23&isauthcode=true", "MobileVersion": "No", "MFAUsed": "No" }, "eventID": "a4fbbe77-91a0-4238-804a-64314184edb6", "eventType": "AwsConsoleSignIn", "recipientAccountId": "111122223333" }