本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
使用 Amazon CloudTrail记录 IAM Identity Center SCIM API 调用
IAM Identity Center SCIM 与 Amazon CloudTrail集成，后者可提供用户、角色或采取的操作记录。 Amazon Web Services 服务 CloudTrail 将 SCIM 的 API 调用捕获为事件。使用收集的信息 CloudTrail，您可以确定所请求操作的有关信息、操作的日期和时间、请求参数，等等。要了解更多信息 CloudTrail，请参阅《Amazon CloudTrail 用户指南》。
注意
CloudTrail 在您创建账户 Amazon Web Services 账户 时已在您的账户上启用。但如果您的令牌是在 2024 年 9 月之前创建的，则可能需要轮换访问令牌，才能查看来自 SCIM 的事件。
有关更多信息，请参阅 轮换访问令牌。
SCIM 支持将以下操作记录为中 CloudTrail：
示例
以下是 CloudTrail 事件的部分示例。
示例 1：成功调用 CreateUser 产生的事件。
{
"eventVersion": "1.10",
"userIdentity": {
"type": "WebIdentityUser",
"accountId": "123456789012",
"accessKeyId": "xxxx"
},
"eventTime": "xxxx",
"eventSource": "identitystore-scim.amazonaws.com",
"eventName": "CreateUser",
"awsRegion": "us-east-1",
"sourceIPAddress": "xx.xxx.xxx.xxx",
"userAgent": "Go-http-client/2.0",
"requestParameters": {
"httpBody": {
"displayName": "HIDDEN_DUE_TO_SECURITY_REASONS",
"schemas" : [
"urn:ietf:params:scim:schemas:core:2.0:User"
],
"name": {
"familyName": "HIDDEN_DUE_TO_SECURITY_REASONS",
"givenName": "HIDDEN_DUE_TO_SECURITY_REASONS"
},
"active": true,
"userName": "HIDDEN_DUE_TO_SECURITY_REASONS"
},
"tenantId": "xxxx"
},
"responseElements": {
"meta" : {
"created" : "Oct 10, 2024, 1:23:45 PM",
"lastModified" : "Oct 10, 2024, 1:23:45 PM",
"resourceType" : "User"
},
"displayName" : "HIDDEN_DUE_TO_SECURITY_REASONS",
"schemas" : [
"urn:ietf:params:scim:schemas:core:2.0:User"
],
"name": {
"familyName": "HIDDEN_DUE_TO_SECURITY_REASONS",
"givenName": "HIDDEN_DUE_TO_SECURITY_REASONS"
},
"active": true,
"id" : "c4488478-a0e1-700e-3d75-96c6bb641596",
"userName": "HIDDEN_DUE_TO_SECURITY_REASONS"
},
"requestID": "xxxx",
"eventID": "xxxx",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "123456789012",
"eventCategory": "Management",
"tlsDetails": {
"clientProvidedHostHeader": "scim.us-east-1.amazonaws.com"
}
}示例 2：由于缺少路径会导致 Missing path in PATCH request 错误消息的 PatchGroup 中的事件。
{
"eventVersion": "1.10",
"userIdentity": {
"type": "Unknown",
"accountId": "123456789012",
"accessKeyId": "xxxx"
},
"eventTime": "xxxx",
"eventSource": "identitystore-scim.amazonaws.com",
"eventName": "PatchGroup",
"awsRegion": "us-east-1",
"sourceIPAddress": "xxx.xxx.xxx.xxx",
"userAgent": "Go-http-client/2.0",
"errorCode": "ValidationException",
"errorMessage": "Missing path in PATCH request",
"requestParameters": {
"httpBody": {
"operations": [
{
"op": "REMOVE",
"value": "HIDDEN_DUE_TO_SECURITY_REASONS"
}
],
"schemas": [
"HIDDEN_DUE_TO_SECURITY_REASONS"
]
},
"tenantId": "xxxx",
"id": "xxxx"
},
"responseElements": null,
"requestID": "xxxx",
"eventID": "xxxx",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "123456789012",
"eventCategory": "Management",
"tlsDetails": {
"clientProvidedHostHeader": "scim.us-east-1.amazonaws.com"
}
}
示例 3：由于存在正在尝试创建的组的名称，会导致Duplicate GroupDisplayName错误消息的CreateGroup调用中的事件。
{
"eventVersion": "1.10",
"userIdentity": {
"type": "Unknown",
"accountId": "123456789012",
"accessKeyId": "xxxx"
},
"eventTime": "xxxx",
"eventSource": "identitystore-scim.amazonaws.com",
"eventName": "CreateGroup",
"awsRegion": "us-east-1",
"sourceIPAddress": "xxx.xxx.xxx.xxx",
"userAgent": "Go-http-client/2.0",
"errorCode": "ConflictException",
"errorMessage": "Duplicate GroupDisplayName",
"requestParameters": {
"httpBody": {
"displayName": "HIDDEN_DUE_TO_SECURITY_REASONS"
},
"tenantId": "xxxx"
},
"responseElements": null,
"requestID": "xxxx",
"eventID": "xxxx",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "123456789012",
"eventCategory": "Management",
"tlsDetails": {
"clientProvidedHostHeader": "scim.us-east-1.amazonaws.com"
}
}
示例 4：会导致 List attribute emails exceeds allowed limit of 1 error 错误消息的 PatchUser 调用中的事件。用户只能有一个电子邮件地址。
{ "eventVersion": "1.10", "userIdentity": { "type": "Unknown", "accountId": "123456789012", "accessKeyId": "xxxx" }, "eventTime": "xxxx", "eventSource": "identitystore-scim.amazonaws.com", "eventName": "PatchUser", "awsRegion": "us-east-1", "sourceIPAddress": "xxx.xxx.xxx.xxx", "userAgent": "Go-http-client/2.0", "errorCode": "ValidationException", "errorMessage": "List attribute emails exceeds allowed limit of 1", "requestParameters": { "httpBody": { "operations": [ { "op": "REPLACE", "path": "emails", "value": "HIDDEN_DUE_TO_SECURITY_REASONS" } ], "schemas": [ "HIDDEN_DUE_TO_SECURITY_REASONS" ] }, "tenantId": "xxxx", "id": "xxxx" }, "responseElements": null, "requestID": "xxxx", "eventID": "xxxx", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "123456789012", "eventCategory": "Management", "tlsDetails": { "clientProvidedHostHeader": "scim.us-east-1.amazonaws.com" } }
常见错误消息
以下是可能在 IAM Identity Center SCIM API 调用 CloudTrail 的事件中收到的常见验证错误消息：
-
List attribute email exceeds allowed limit of 1 -
List attribute addresses allowed limit of 1 -
1 validation errors detected: Value at '*name.familyName*' failed to satisfy constraint: Member must satisfy regular expression pattern: [\\p{L}\\p{M}\\p{S}\\p{N}\\p{P}\\t\\n\\r ]+ -
2 validation errors detected: Value at 'name.familyName' failed to satisfy constraint: Member must have length greater than or equal to 1; Value at 'name.familyName' failed to satisfy constraint: Member must satisfy regular expression pattern: [\\p{L}\\p{M}\\p{S}\\p{N}\\p{P}\\t\\n\\r ]+ -
2 validation errors detected: Value at 'urn:ietf:params:scim:schemas:extension:enterprise:2.0:User.manager.value' failed to satisfy constraint: Member must have length greater than or equal to 1; Value at 'urn:ietf:params:scim:schemas:extension:enterprise:2.0:User.manager.value' failed to satisfy constraint: Member must satisfy regular expression pattern: [\\p{L}\\p{M}\\p{S}\\p{N}\\p{P}\\t\\n\\r ]+", -
来自的 JSON RequestBody -
Invalid Filter format
有关 IAM Identity Center SCIM 预置错误问题排查的更多信息，请参阅 Amazon Web Services re:Post
文章