本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# 监控 Amazon Web Services 支持 授权 Amazon CloudTrail
<a name="support-authorization-monitoring"></a>

Amazon CloudTrail 将所有 Amazon Web Services 支持 授权 API 调用和支持操作记录为管理事件。默认情况下，将记录这些事件，无需额外配置。

## Amazon 服务事件
<a name="support-authorization-monitoring-service-events"></a>

在 Amazon Web Services 支持 执行与您的支持许可相关的操作时，将以下事件作为`AwsServiceEvent`类型 Amazon CloudTrail 传送。所有事件的事件源是`supportauthz.amazonaws.com`。

### SupportPermitRequestCreated
<a name="support-authorization-monitoring-request"></a>

Amazon CloudTrail 在 Amazon Web Services 支持 请求访问您的资源时记录此事件。它表示已创建支持许可申请。

```
{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "111122223333",
        "invokedBy": "supportauthz.amazonaws.com"
    },
    "eventTime": "2026-06-16T20:04:51Z",
    "eventSource": "supportauthz.amazonaws.com",
    "eventName": "SupportPermitRequestCreated",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "supportauthz.amazonaws.com",
    "userAgent": "supportauthz.amazonaws.com",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "readOnly": false,
    "resources": [
        {
            "accountId": "111122223333",
            "type": "AWS::SupportAuthZ::SupportPermitRequest",
            "ARN": "arn:aws:supportauthz:us-east-1:111122223333:supportpermitrequest/e5f6a7b8-c9d0-1234-efab-345678901234"
        }
    ],
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "supportPermitRequestArn": "arn:aws:supportauthz:us-east-1:111122223333:supportpermitrequest/e5f6a7b8-c9d0-1234-efab-345678901234",
        "supportCaseDisplayId": "1234567890",
        "resources": ["arn:aws:example:us-east-1:111122223333:resourcetype/resource-id"],
        "actions": ["example:ExampleAction"]
    },
    "eventCategory": "Management"
}
```

### RetrieveSupportPermit
<a name="support-authorization-monitoring-get"></a>

Amazon CloudTrail 在 Amazon Web Services 支持 检索执行支持操作的签名授权时记录此事件。这表示您的 Amazon KMS 密钥用于签署授权。

```
{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "111122223333",
        "invokedBy": "supportauthz.amazonaws.com"
    },
    "eventTime": "2026-06-16T20:22:42Z",
    "eventSource": "supportauthz.amazonaws.com",
    "eventName": "RetrieveSupportPermit",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "supportauthz.amazonaws.com",
    "userAgent": "supportauthz.amazonaws.com",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
    "readOnly": true,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "supportCaseDisplayId": "1234567890",
        "resource": "arn:aws:example:us-east-1:111122223333:resourcetype/resource-id",
        "action": "example:ExampleAction",
        "supportPermitArn": "arn:aws:supportauthz:us-east-1:111122223333:supportpermit/f6a7b8c9-d0e1-2345-fabc-456789012345"
    },
    "eventCategory": "Management"
}
```

### StartSupportAction
<a name="support-authorization-monitoring-execute"></a>

Amazon CloudTrail 在对您的资源 Amazon Web Services 支持 执行授权操作时记录此事件。

```
{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "111122223333",
        "invokedBy": "supportauthz.amazonaws.com"
    },
    "eventTime": "2026-06-17T21:38:37Z",
    "eventSource": "supportauthz.amazonaws.com",
    "eventName": "StartSupportAction",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "supportauthz.amazonaws.com",
    "userAgent": "supportauthz.amazonaws.com",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "c3d4e5f6-a7b8-9012-cdef-123456789012",
    "readOnly": false,
    "resources": [
        {
            "accountId": "111122223333",
            "type": "AWS::SupportAuthZ::SupportPermit",
            "ARN": "arn:aws:supportauthz:us-west-2:111122223333:supportpermit/example-permit"
        }
    ],
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "supportCaseDisplayId": "1234567890",
        "resourceIdentifiers": ["arn:aws:example:us-east-1:111122223333:resourcetype/resource-id"],
        "action": "example:ExampleAction",
        "supportPermitArn": "arn:aws:supportauthz:us-east-1:111122223333:supportpermit/f6a7b8c9-d0e1-2345-fabc-456789012345"
    },
    "eventCategory": "Management"
}
```

**注意**  
一次签名的授权可能会导致多个`StartSupportAction`事件。每个事件代表对一个资源执行的一项操作。例如，如果在支持案例期间多次 Amazon Web Services 支持 读取集群的诊断数据，则每次访问都会生成一个引用该群集的单独`StartSupportAction`事件。`customerPermitArn`

### CancelSupportPermitRequest
<a name="support-authorization-monitoring-cancel"></a>

Amazon CloudTrail Amazon Web Services 支持 取消支持许可请求时记录此事件。

```
{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "111122223333",
        "invokedBy": "supportauthz.amazonaws.com"
    },
    "eventTime": "2026-06-16T20:04:42Z",
    "eventSource": "supportauthz.amazonaws.com",
    "eventName": "CancelSupportPermitRequest",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "supportauthz.amazonaws.com",
    "userAgent": "supportauthz.amazonaws.com",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "d4e5f6a7-b8c9-0123-defa-234567890123",
    "readOnly": false,
    "resources": [
        {
            "accountId": "111122223333",
            "type": "AWS::SupportAuthZ::SupportPermitRequest",
            "ARN": "arn:aws:supportauthz:us-east-1:111122223333:supportpermitrequest/a7b8c9d0-e1f2-3456-abcd-567890123456"
        }
    ],
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "supportPermitRequestArn": "arn:aws:supportauthz:us-east-1:111122223333:supportpermitrequest/a7b8c9d0-e1f2-3456-abcd-567890123456"
    },
    "eventCategory": "Management"
}
```

## API 事件
<a name="support-authorization-monitoring-customer-events"></a>

Amazon CloudTrail 还会为您自己的 API Amazon Web Services 支持 授权调用生成标准管理事件，包括`CreateSupportPermit``DeleteSupportPermit`、`GetSupportPermit`、`ListSupportPermits`、`ListSupportPermitRequests`、和`RejectSupportPermitRequest`。

## 设置警报
<a name="support-authorization-monitoring-alerts"></a>

您可以根据 Amazon CloudTrail 事件创建亚马逊 CloudWatch 警报，在 Amazon Web Services 支持 请求访问您的资源或对您的资源执行操作时提醒您。要设置警报，请执行以下操作：

1. 创建向亚马逊 CloudWatch日志传送事件的 Amazon CloudTrail 跟踪。

1. 为 Amazon CloudTrail 日志组创建与`eventSource`值`supportauthz.amazonaws.com`和所需值`eventName`（例如，`SupportPermitRequestCreated`或`StartSupportAction`）相匹配的指标筛选器。

1. 在指标筛选器上创建 CloudWatch 警报，通过 Amazon SNS 通知您。

## 亚马逊 EventBridge 活动
<a name="support-authorization-monitoring-eventbridge"></a>

创建支持许可请求 EventBridge 时，会将事件发送给亚马逊。您可以使用这些事件来自动响应，例如自动为低风险操作创建支持许可或通知您的安全团队进行审查。

以下是新的支持许可请求的示例事件：

```
{
    "version": "0",
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "detail-type": "Support Permit Request Created",
    "source": "aws.supportauthz",
    "account": "111122223333",
    "time": "2026-06-01T12:00:00Z",
    "region": "us-east-1",
    "detail": {
        "requestArn": "arn:aws:supportauthz:us-east-1:111122223333:supportpermitrequest/req-1234abcd",
        "supportCaseDisplayId": "case-12345678",
        "requestedActions": ["rds:ReadClusterData"],
        "requestedResources": ["arn:aws:rds:us-east-1:111122223333:cluster:my-aurora-cluster"],
        "status": "PENDING"
    }
}
```

要创建与支持许可请求事件相匹配的亚马逊 EventBridge 规则，请使用以下事件模式：

```
{
    "source": ["aws.supportauthz"],
    "detail-type": ["Support Permit Request Created"]
}
```

您可以将这些事件路由到 Lambda 函数、亚马逊 SNS 主题或 Amazon SQS 队列等目标，以构建自动批准工作流程。