View a markdown version of this page

监控 Amazon Web Services 支持 授权 Amazon CloudTrail - Amazon Web Services 支持
Amazon 服务事件API 事件设置警报亚马逊 EventBridge 活动
Amazon Web Services 文档中描述的 Amazon Web Services 服务或功能可能因区域而异。要查看适用于中国区域的差异，请参阅 中国的 Amazon Web Services 服务入门 (PDF)。

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

监控 Amazon Web Services 支持 授权 Amazon CloudTrail

Amazon CloudTrail 将所有 Amazon Web Services 支持 授权 API 调用和支持操作记录为管理事件。默认情况下，将记录这些事件，无需额外配置。

Amazon 服务事件

在 Amazon Web Services 支持 执行与您的支持许可相关的操作时，将以下事件作为AwsServiceEvent类型 Amazon CloudTrail 传送。所有事件的事件源是supportauthz.amazonaws.com。

SupportPermitRequestCreated

Amazon CloudTrail 在 Amazon Web Services 支持 请求访问您的资源时记录此事件。它表示已创建支持许可申请。

{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "111122223333",
        "invokedBy": "supportauthz.amazonaws.com"
    },
    "eventTime": "2026-06-16T20:04:51Z",
    "eventSource": "supportauthz.amazonaws.com",
    "eventName": "SupportPermitRequestCreated",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "supportauthz.amazonaws.com",
    "userAgent": "supportauthz.amazonaws.com",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "readOnly": false,
    "resources": [
        {
            "accountId": "111122223333",
            "type": "AWS::SupportAuthZ::SupportPermitRequest",
            "ARN": "arn:aws:supportauthz:us-east-1:111122223333:supportpermitrequest/e5f6a7b8-c9d0-1234-efab-345678901234"
        }
    ],
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "supportPermitRequestArn": "arn:aws:supportauthz:us-east-1:111122223333:supportpermitrequest/e5f6a7b8-c9d0-1234-efab-345678901234",
        "supportCaseDisplayId": "1234567890",
        "resources": ["arn:aws:example:us-east-1:111122223333:resourcetype/resource-id"],
        "actions": ["example:ExampleAction"]
    },
    "eventCategory": "Management"
}

RetrieveSupportPermit

Amazon CloudTrail 在 Amazon Web Services 支持 检索执行支持操作的签名授权时记录此事件。这表示您的 Amazon KMS 密钥用于签署授权。

{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "111122223333",
        "invokedBy": "supportauthz.amazonaws.com"
    },
    "eventTime": "2026-06-16T20:22:42Z",
    "eventSource": "supportauthz.amazonaws.com",
    "eventName": "RetrieveSupportPermit",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "supportauthz.amazonaws.com",
    "userAgent": "supportauthz.amazonaws.com",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
    "readOnly": true,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "supportCaseDisplayId": "1234567890",
        "resource": "arn:aws:example:us-east-1:111122223333:resourcetype/resource-id",
        "action": "example:ExampleAction",
        "supportPermitArn": "arn:aws:supportauthz:us-east-1:111122223333:supportpermit/f6a7b8c9-d0e1-2345-fabc-456789012345"
    },
    "eventCategory": "Management"
}

StartSupportAction

Amazon CloudTrail 在对您的资源 Amazon Web Services 支持 执行授权操作时记录此事件。

{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "111122223333",
        "invokedBy": "supportauthz.amazonaws.com"
    },
    "eventTime": "2026-06-17T21:38:37Z",
    "eventSource": "supportauthz.amazonaws.com",
    "eventName": "StartSupportAction",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "supportauthz.amazonaws.com",
    "userAgent": "supportauthz.amazonaws.com",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "c3d4e5f6-a7b8-9012-cdef-123456789012",
    "readOnly": false,
    "resources": [
        {
            "accountId": "111122223333",
            "type": "AWS::SupportAuthZ::SupportPermit",
            "ARN": "arn:aws:supportauthz:us-west-2:111122223333:supportpermit/example-permit"
        }
    ],
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "supportCaseDisplayId": "1234567890",
        "resourceIdentifiers": ["arn:aws:example:us-east-1:111122223333:resourcetype/resource-id"],
        "action": "example:ExampleAction",
        "supportPermitArn": "arn:aws:supportauthz:us-east-1:111122223333:supportpermit/f6a7b8c9-d0e1-2345-fabc-456789012345"
    },
    "eventCategory": "Management"
}
注意

一次签名的授权可能会导致多个StartSupportAction事件。每个事件代表对一个资源执行的一项操作。例如，如果在支持案例期间多次 Amazon Web Services 支持 读取集群的诊断数据，则每次访问都会生成一个引用该群集的单独StartSupportAction事件。customerPermitArn

CancelSupportPermitRequest

Amazon CloudTrail Amazon Web Services 支持 取消支持许可请求时记录此事件。

{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "111122223333",
        "invokedBy": "supportauthz.amazonaws.com"
    },
    "eventTime": "2026-06-16T20:04:42Z",
    "eventSource": "supportauthz.amazonaws.com",
    "eventName": "CancelSupportPermitRequest",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "supportauthz.amazonaws.com",
    "userAgent": "supportauthz.amazonaws.com",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "d4e5f6a7-b8c9-0123-defa-234567890123",
    "readOnly": false,
    "resources": [
        {
            "accountId": "111122223333",
            "type": "AWS::SupportAuthZ::SupportPermitRequest",
            "ARN": "arn:aws:supportauthz:us-east-1:111122223333:supportpermitrequest/a7b8c9d0-e1f2-3456-abcd-567890123456"
        }
    ],
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "supportPermitRequestArn": "arn:aws:supportauthz:us-east-1:111122223333:supportpermitrequest/a7b8c9d0-e1f2-3456-abcd-567890123456"
    },
    "eventCategory": "Management"
}

API 事件

Amazon CloudTrail 还会为您自己的 API Amazon Web Services 支持 授权调用生成标准管理事件，包括CreateSupportPermitDeleteSupportPermit、GetSupportPermit、ListSupportPermits、ListSupportPermitRequests、和RejectSupportPermitRequest。

设置警报

您可以根据 Amazon CloudTrail 事件创建亚马逊 CloudWatch 警报，在 Amazon Web Services 支持 请求访问您的资源或对您的资源执行操作时提醒您。要设置警报，请执行以下操作：

  1. 创建向亚马逊 CloudWatch日志传送事件的 Amazon CloudTrail 跟踪。

  2. 为 Amazon CloudTrail 日志组创建与eventSource值supportauthz.amazonaws.com和所需值eventName（例如，SupportPermitRequestCreated或StartSupportAction）相匹配的指标筛选器。

  3. 在指标筛选器上创建 CloudWatch 警报，通过 Amazon SNS 通知您。

亚马逊 EventBridge 活动

创建支持许可请求 EventBridge 时，会将事件发送给亚马逊。您可以使用这些事件来自动响应，例如自动为低风险操作创建支持许可或通知您的安全团队进行审查。

以下是新的支持许可请求的示例事件：

{
    "version": "0",
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "detail-type": "Support Permit Request Created",
    "source": "aws.supportauthz",
    "account": "111122223333",
    "time": "2026-06-01T12:00:00Z",
    "region": "us-east-1",
    "detail": {
        "requestArn": "arn:aws:supportauthz:us-east-1:111122223333:supportpermitrequest/req-1234abcd",
        "supportCaseDisplayId": "case-12345678",
        "requestedActions": ["rds:ReadClusterData"],
        "requestedResources": ["arn:aws:rds:us-east-1:111122223333:cluster:my-aurora-cluster"],
        "status": "PENDING"
    }
}

要创建与支持许可请求事件相匹配的亚马逊 EventBridge 规则，请使用以下事件模式：

{
    "source": ["aws.supportauthz"],
    "detail-type": ["Support Permit Request Created"]
}

您可以将这些事件路由到 Lambda 函数、亚马逊 SNS 主题或 Amazon SQS 队列等目标，以构建自动批准工作流程。