从补丁 198 开始，Amazon Redshift 将不再支持创建新的 Python UDF。现有的 Python UDF 将继续正常运行至 2026 年 6 月 30 日。有关更多信息，请参阅[博客文章](https://www.amazonaws.cn/blogs/big-data/amazon-redshift-python-user-defined-functions-will-reach-end-of-support-after-june-30-2026/)。
# 使用 Cloudtrail 进行日志记录
Amazon Redshift、数据共享、Amazon Redshift Serverless、Amazon Redshift 数据 API 和查询编辑器 v2 都与 Amazon CloudTrail 集成。CloudTrail 服务提供用户、角色或 Amazon 服务在 Amazon Redshift 中所执行的操作的记录。CloudTrail 将 Amazon Redshift 的所有 API 调用作为事件捕获。捕获的调用包括通过 Redshift 控制台进行的调用以及对 Redshift 操作的代码调用。
如果您创建 CloudTrail 跟踪记录，则可以让 CloudTrail 事件持续传送到 Amazon S3 桶（包括 Redshift 的事件）。如果您不配置跟踪记录，则仍可在 CloudTrail 控制台中的 **Event history（事件历史记录）**中查看最新事件。通过使用 CloudTrail 收集的信息，您可以确定某些事项。这些事项包括向 Redshift 发出的请求、发出请求的 IP 地址、何人发出的请求、请求的发出时间，以及其他详细信息。
您可以将 CloudTrail 与 Amazon Redshift 数据库审计日志记录一起使用，也可以单独使用前者。
要了解有关 CloudTrail 的更多信息，请参阅 [Amazon CloudTrail 用户指南](https://docs.amazonaws.cn/awscloudtrail/latest/userguide/)。
## CloudTrail 中的 信息
在您创建账户时，您的 Amazon 账户中已启用 CloudTrail。发生活动时，该活动将记录在 CloudTrail 事件中，并与其他 Amazon 服务事件一同保存在 **Event history**（事件历史记录）中。您可以在 Amazon 账户中查看、搜索和下载最新事件。有关更多信息，请参阅《Amazon CloudTrail 用户指南》**中的[使用 CloudTrail 事件历史记录查看事件](https://docs.amazonaws.cn/awscloudtrail/latest/userguide/view-cloudtrail-events.html)。
要持续记录 Amazon 账户中的事件（包括 Redshift 的事件），请创建跟踪记录。CloudTrail 使用*跟踪记录* 将日志文件传送至 Amazon S3 桶。预设情况下，在控制台中创建跟踪时，此跟踪应用于所有 Amazon 区域。此跟踪记录在 Amazon 分区中记录所有区域中的事件，并将日志文件传送至您指定的 Amazon S3 存储桶。此外，您可以配置其他Amazon服务，进一步分析在 CloudTrail 日志中收集的事件数据并采取行动。有关更多信息，请参阅《Amazon CloudTrail 用户指南》**中的以下内容：
+ [创建跟踪概览](https://docs.amazonaws.cn/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html)
+ [CloudTrail 支持的服务和集成](https://docs.amazonaws.cn/awscloudtrail/latest/userguide/cloudtrail-aws-service-specific-topics.html#cloudtrail-aws-service-specific-topics-integrations)
+ [为 CloudTrail 配置 Amazon SNS 通知](https://docs.amazonaws.cn/awscloudtrail/latest/userguide/getting_notifications_top_level.html)
+ [从多个区域接收 CloudTrail 日志文件](https://docs.amazonaws.cn/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html)和[从多个账户接收 CloudTrail 日志文件](https://docs.amazonaws.cn/awscloudtrail/latest/userguide/cloudtrail-receive-logs-from-multiple-accounts.html)
所有 Amazon Redshift、Amazon Redshift Serverless、数据 API、数据共享和查询编辑器 v2 操作都由 CloudTrail 记录。例如，对 `AuthorizeDatashare`、`CreateNamespace`、`ExecuteStatement` 和 `CreateConnection` 操作的调用将在 CloudTrail 日志文件中生成条目。
每个事件或日志条目都包含有关生成请求的人员信息。身份信息有助于您确定以下内容：
+ 请求是使用根凭证还是用户凭证发出的。
+ 请求是使用角色还是联合用户的临时安全凭证发出的。
+ 请求是否由其他Amazon服务发出。
有关更多信息，请参阅《Amazon CloudTrail 用户指南》**中的 [CloudTrail userIdentity 元素](https://docs.amazonaws.cn/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html)。
## 日志文件条目
*跟踪记录* 是一种配置，允许将事件作为日志文件传送到您指定的 Amazon S3 桶。CloudTrail 日志文件包含一个或多个日记账条目。一个*事件*表示来自任何源的一个请求，包括有关所请求的操作、操作的日期和时间、请求参数等方面的信息。CloudTrail 日志文件不是公用 API 调用的有序堆栈跟踪，因此它们不会按任何特定顺序显示。
## Amazon Redshift 数据共享示例
下面的示例显示了一个 CloudTrail 日志条目，该条目说明了 `AuthorizeDataShare` 操作。
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "AssumedRole",
"principalId": "AKIAIOSFODNN7EXAMPLE:janedoe",
"arn": "arn:aws:sts::111122223333:user/janedoe",
"accountId": "111122223333",
"accessKeyId": "AKIAI44QH8DHBEXAMPLE",
"sessionContext": {
"sessionIssuer": {
"type": "Role",
"principalId": "AKIAIOSFODNN7EXAMPLE:janedoe",
"arn": "arn:aws:sts::111122223333:user/janedoe",
"accountId": "111122223333",
"userName": "janedoe"
},
"attributes": {
"creationDate": "2021-08-02T23:40:45Z",
"mfaAuthenticated": "false"
}
}
},
"eventTime": "2021-08-02T23:40:58Z",
"eventSource": "redshift.amazonaws.com",
"eventName": "AuthorizeDataShare",
"awsRegion": "us-east-1",
"sourceIPAddress": "3.227.36.75",
"userAgent":"aws-cli/1.18.118 Python/3.6.10 Linux/4.9.217-0.1.ac.205.84.332.metal1.x86_64 botocore/1.17.41",
"requestParameters": {
"dataShareArn": "arn:aws:redshift:us-east-1:111122223333:datashare:4c64c6ec-73d5-42be-869b-b7f7c43c7a53/testshare",
"consumerIdentifier": "555555555555"
},
"responseElements": {
"dataShareArn": "arn:aws:redshift:us-east-1:111122223333:datashare:4c64c6ec-73d5-42be-869b-b7f7c43c7a53/testshare",
"producerNamespaceArn": "arn:aws:redshift:us-east-1:123456789012:namespace:4c64c6ec-73d5-42be-869b-b7f7c43c7a53",
"producerArn": "arn:aws:redshift:us-east-1:111122223333:namespace:4c64c6ec-73d5-42be-869b-b7f7c43c7a53",
"allowPubliclyAccessibleConsumers": true,
"dataShareAssociations": [
{
"consumerIdentifier": "555555555555",
"status": "AUTHORIZED",
"createdDate": "Aug 2, 2021 11:40:56 PM",
"statusChangeDate": "Aug 2, 2021 11:40:57 PM"
}
]
},
"requestID": "87ee1c99-9e41-42be-a5c4-00495f928422",
"eventID": "03a3d818-37c8-46a6-aad5-0151803bdb09",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
## Amazon Redshift Serverless 示例
Amazon Redshift Serverless 与 Amazon CloudTrail 集成，以提供在 Amazon Redshift Serverless 中执行的操作的记录。CloudTrail 将 Amazon Redshift Serverless 的所有 API 调用作为事件捕获。有关 Amazon Redshift Serverless 功能的更多信息，请参阅 [Amazon Redshift Serverless 功能概览](https://docs.amazonaws.cn/redshift/latest/mgmt/serverless-considerations.html)。
下面的示例显示了一个 CloudTrail 日志条目，该条目演示了 `CreateNamespace` 操作。
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "AssumedRole",
"principalId": "AAKEOFPINEXAMPLE:admin",
"arn": "arn:aws:sts::111111111111:assumed-role/admin/admin",
"accountId": "111111111111",
"accessKeyId": "AAKEOFPINEXAMPLE",
"sessionContext": {
"sessionIssuer": {
"type": "Role",
"principalId": "AAKEOFPINEXAMPLE",
"arn": "arn:aws:iam::111111111111:role/admin",
"accountId": "111111111111",
"userName": "admin"
},
"webIdFederationData": {},
"attributes": {
"creationDate": "2022-03-21T20:51:58Z",
"mfaAuthenticated": "false"
}
}
},
"eventTime": "2022-03-21T23:15:40Z",
"eventSource": "redshift-serverless.amazonaws.com",
"eventName": "CreateNamespace",
"awsRegion": "us-east-1",
"sourceIPAddress": "56.23.155.33",
"userAgent": "aws-cli/2.4.14 Python/3.8.8 Linux/5.4.181-109.354.amzn2int.x86_64 exe/x86_64.amzn.2 prompt/off command/redshift-serverless.create-namespace",
"requestParameters": {
"adminUserPassword": "HIDDEN_DUE_TO_SECURITY_REASONS",
"adminUsername": "HIDDEN_DUE_TO_SECURITY_REASONS",
"dbName": "dev",
"namespaceName": "testnamespace"
},
"responseElements": {
"namespace": {
"adminUsername": "HIDDEN_DUE_TO_SECURITY_REASONS",
"creationDate": "Mar 21, 2022 11:15:40 PM",
"defaultIamRoleArn": "",
"iamRoles": [],
"logExports": [],
"namespaceArn": "arn:aws:redshift-serverless:us-east-1:111111111111:namespace/befa5123-16c2-4449-afca-1d27cb40fc99",
"namespaceId": "8b726a0c-16ca-4799-acca-1d27cb403599",
"namespaceName": "testnamespace",
"status": "AVAILABLE"
}
},
"requestID": "ed4bb777-8127-4dae-aea3-bac009999163",
"eventID": "1dbee944-f889-4beb-b228-7ad0f312464",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111111111111",
"eventCategory": "Management",
}
```
## Amazon Redshift 数据 API 示例
下面的示例显示了一个 CloudTrail 日志条目，该条目演示了 `ExecuteStatement` 操作。
```
{
"eventVersion":"1.05",
"userIdentity":{
"type":"IAMUser",
"principalId":"AKIAIOSFODNN7EXAMPLE:janedoe",
"arn":"arn:aws:sts::123456789012:user/janedoe",
"accountId":"123456789012",
"accessKeyId":"AKIAI44QH8DHBEXAMPLE",
"userName": "janedoe"
},
"eventTime":"2020-08-19T17:55:59Z",
"eventSource":"redshift-data.amazonaws.com",
"eventName":"ExecuteStatement",
"awsRegion":"us-east-1",
"sourceIPAddress":"192.0.2.0",
"userAgent":"aws-cli/1.18.118 Python/3.6.10 Linux/4.9.217-0.1.ac.205.84.332.metal1.x86_64 botocore/1.17.41",
"requestParameters":{
"clusterIdentifier":"example-cluster-identifier",
"database":"example-database-name",
"dbUser":"example_db_user_name",
"sql":"***OMITTED***"
},
"responseElements":{
"clusterIdentifier":"example-cluster-identifier",
"createdAt":"Aug 19, 2020 5:55:58 PM",
"database":"example-database-name",
"dbUser":"example_db_user_name",
"id":"5c52b37b-9e07-40c1-98de-12ccd1419be7"
},
"requestID":"00c924d3-652e-4939-8a7a-cd0612eeb8ac",
"eventID":"c1fb7076-102f-43e5-9ec9-40820bcc1175",
"readOnly":false,
"eventType":"AwsApiCall",
"recipientAccountId":"123456789012"
}
```
下面的示例显示了一个 CloudTrail 日志条目，该条目说明了 `ExecuteStatement` 操作，显示了幂等性所用的 `clientToken`。
```
{
"eventVersion":"1.05",
"userIdentity":{
"type":"IAMUser",
"principalId":"AKIAIOSFODNN7EXAMPLE:janedoe",
"arn":"arn:aws:sts::123456789012:user/janedoe",
"accountId":"123456789012",
"accessKeyId":"AKIAI44QH8DHBEXAMPLE",
"userName": "janedoe"
},
"eventTime":"2020-08-19T17:55:59Z",
"eventSource":"redshift-data.amazonaws.com",
"eventName":"ExecuteStatement",
"awsRegion":"us-east-1",
"sourceIPAddress":"192.0.2.0",
"userAgent":"aws-cli/1.18.118 Python/3.6.10 Linux/4.9.217-0.1.ac.205.84.332.metal1.x86_64 botocore/1.17.41",
"requestParameters":{
"clusterIdentifier":"example-cluster-identifier",
"database":"example-database-name",
"dbUser":"example_db_user_name",
"sql":"***OMITTED***",
"clientToken":"32db2e10-69ac-4534-b3fc-a191052616ce"
},
"responseElements":{
"clusterIdentifier":"example-cluster-identifier",
"createdAt":"Aug 19, 2020 5:55:58 PM",
"database":"example-database-name",
"dbUser":"example_db_user_name",
"id":"5c52b37b-9e07-40c1-98de-12ccd1419be7"
},
"requestID":"00c924d3-652e-4939-8a7a-cd0612eeb8ac",
"eventID":"c1fb7076-102f-43e5-9ec9-40820bcc1175",
"readOnly":false,
"eventType":"AwsApiCall",
"recipientAccountId":"123456789012"
}
```
## Amazon Redshift 查询编辑器 v2 示例
下面的示例显示了一个 CloudTrail 日志条目，该条目演示了 `CreateConnection` 操作。
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "AssumedRole",
"principalId": "AAKEOFPINEXAMPLE:session",
"arn": "arn:aws:sts::123456789012:assumed-role/MyRole/session",
"accountId": "123456789012",
"accessKeyId": "AKIAI44QH8DHBEXAMPLE",
"sessionContext": {
"sessionIssuer": {
"type": "Role",
"principalId": "AAKEOFPINEXAMPLE",
"arn": "arn:aws:iam::123456789012:role/MyRole",
"accountId": "123456789012",
"userName": "MyRole"
},
"webIdFederationData": {},
"attributes": {
"creationDate": "2022-09-21T17:19:02Z",
"mfaAuthenticated": "false"
}
}
},
"eventTime": "2022-09-21T22:22:05Z",
"eventSource": "sqlworkbench.amazonaws.com",
"eventName": "CreateConnection",
"awsRegion": "ca-central-1",
"sourceIPAddress": "192.2.0.2",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0",
"requestParameters": {
"password": "***",
"databaseName": "***",
"isServerless": false,
"name": "***",
"host": "redshift-cluster-2.c8robpbxvbf9.ca-central-1.redshift.amazonaws.com",
"authenticationType": "***",
"clusterId": "redshift-cluster-2",
"username": "***",
"tags": {
"sqlworkbench-resource-owner": "AAKEOFPINEXAMPLE:session"
}
},
"responseElements": {
"result": true,
"code": "",
"data": {
"id": "arn:aws:sqlworkbench:ca-central-1:123456789012:connection/ce56b1be-dd65-4bfb-8b17-12345123456",
"name": "***",
"authenticationType": "***",
"databaseName": "***",
"secretArn": "arn:aws:secretsmanager:ca-central-1:123456789012:secret:sqlworkbench!7da333b4-9a07-4917-b1dc-12345123456-qTCoFm",
"clusterId": "redshift-cluster-2",
"dbUser": "***",
"userSettings": "***",
"recordDate": "2022-09-21 22:22:05",
"updatedDate": "2022-09-21 22:22:05",
"accountId": "123456789012",
"tags": {
"sqlworkbench-resource-owner": "AAKEOFPINEXAMPLE:session"
},
"isServerless": false
}
},
"requestID": "9b82f483-9c03-4cdd-bb49-a7009e7da714",
"eventID": "a7cdd442-e92f-46a2-bc82-2325588d41c3",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "123456789012",
"eventCategory": "Management"
}
```
## Amazon CloudTrail 日志中的 Amazon Redshift 账户 ID
当 Amazon Redshift 为您调用其他 Amazon 服务时，该次调用将以属于 Amazon Redshift 的账户 ID 记录下来。它未以您的账户 ID 记录。例如，假设 Amazon Redshift 调用 Amazon Key Management Service（Amazon KMS）操作（如 `CreateGrant`、`Decrypt`、`Encrypt` 和 `RetireGrant`）以管理集群上的加密。在这种情况下，调用由 Amazon CloudTrail 使用 Amazon Redshift 账户 ID 记录。
当调用其他 Amazon 服务时，Amazon Redshift 使用下表中的账户 ID。
[\[See the AWS documentation website for more details\]](http://docs.amazonaws.cn/redshift/latest/mgmt/logging-with-cloudtrail.html)
以下示例显示了 Amazon Redshift 所调用的 Amazon KMS Decrypt 操作的 CloudTrail 日志条目。
```
{
"eventVersion": "1.05",
"userIdentity": {
"type": "AssumedRole",
"principalId": "AROAI5QPCMKLTL4VHFCYY:i-0f53e22dbe5df8a89",
"arn": "arn:aws:sts::790247189693:assumed-role/prod-23264-role-wp/i-0f53e22dbe5df8a89",
"accountId": "790247189693",
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"sessionContext": {
"attributes": {
"mfaAuthenticated": "false",
"creationDate": "2017-03-03T16:24:54Z"
},
"sessionIssuer": {
"type": "Role",
"principalId": "AROAI5QPCMKLTL4VHFCYY",
"arn": "arn:aws:iam::790247189693:role/prod-23264-role-wp",
"accountId": "790247189693",
"userName": "prod-23264-role-wp"
}
}
},
"eventTime": "2017-03-03T17:16:51Z",
"eventSource": "kms.amazonaws.com",
"eventName": "Decrypt",
"awsRegion": "us-east-2",
"sourceIPAddress": "52.14.143.61",
"userAgent": "aws-internal/3",
"requestParameters": {
"encryptionContext": {
"aws:redshift:createtime": "20170303T1710Z",
"aws:redshift:arn": "arn:aws:redshift:us-east-2:123456789012:cluster:my-dw-instance-2"
}
},
"responseElements": null,
"requestID": "30d2fe51-0035-11e7-ab67-17595a8411c8",
"eventID": "619bad54-1764-4de4-a786-8898b0a7f40c",
"readOnly": true,
"resources": [
{
"ARN": "arn:aws:kms:us-east-2:123456789012:key/f8f4f94f-e588-4254-b7e8-078b99270be7",
"accountId": "123456789012",
"type": "AWS::KMS::Key"
}
],
"eventType": "AwsApiCall",
"recipientAccountId": "123456789012",
"sharedEventID": "c1daefea-a5c2-4fab-b6f4-d8eaa1e522dc"
}
```