Log API Calls for EBS direct APIs with Amazon CloudTrail
The EBS direct APIs service is integrated with Amazon CloudTrail. CloudTrail is a service that provides a record of actions taken by a user, role, or an Amazon service. CloudTrail captures all API calls performed in EBS direct APIs as events. If you create a trail, you can enable continuous delivery of CloudTrail events to an Amazon Simple Storage Service (Amazon S3) bucket. If you don't configure a trail, you can still view the most recent management events in the CloudTrail console in Event history. Data events are not captured in Event history. You can use the information collected by CloudTrail to determine the request that was made to EBS direct APIs, the IP address from which the request was made, who made the request, when it was made, and additional details.
For more information about CloudTrail, see the Amazon CloudTrail User Guide.
EBS direct APIs Information in CloudTrail
CloudTrail is enabled on your Amazon account when you create the account. When supported event activity occurs in EBS direct APIs, that activity is recorded in a CloudTrail event along with other Amazon service events in Event history. You can view, search, and download recent events in your Amazon account. For more information, see Viewing Events with CloudTrail Event History.
For an ongoing record of events in your Amazon account, including events for EBS direct APIs, create a trail. A trail enables CloudTrail to deliver log files to an S3 bucket. By default, when you create a trail in the console, the trail applies to all Amazon Regions. The trail logs events from all Regions in the Amazon partition and delivers the log files to the S3 bucket that you specify. Additionally, you can configure other Amazon services to further analyze and act upon the event data collected in CloudTrail logs. For more information, see the following:
Supported API actions
For EBS direct APIs, you can use CloudTrail to log two types of events:
-
Management events — Management events provide visibility into management operations that are performed on snapshots in your Amazon account. The following API actions are logged by default as management events in trails:
For more information about logging management events, see Logging management events for trails in the CloudTrail User Guide.
-
Data events — These events provide visibility into the snapshot operations performed on or within a snapshot. The following API actions can optionally be logged as data events in trails:
Data events are not logged by default when you create a trail. You can use only advanced event selectors to record data events on EBS direct API calls. For more information, see Logging data events for trails in the CloudTrail User Guide.
Note
If you perform an action on a snapshot that is shared with you, data events are not sent to the Amazon account that owns the snapshot.
Identity information
Every event or log entry contains information about who generated the request. The identity information helps you determine the following:
-
Whether the request was made with root user or user credentials.
-
Whether the request was made with temporary security credentials for a role or federated user.
-
Whether the request was made by another Amazon service.
For more information, see the CloudTrail userIdentityElement.
Understand EBS direct APIs Log File Entries
A trail is a configuration that enables delivery of events as log files to an S3 bucket that you specify. CloudTrail log files contain one or more log entries. An event represents a single request from any source and includes information about the requested action, the date and time of the action, request parameters, and so on. CloudTrail log files aren't an ordered stack trace of the public API calls, so they don't appear in any specific order.
The following are example CloudTrail log entries.