share facebook facebook2 twitter menu hatena pocket slack

2013.11.20 WED

re:Inventってなんじゃ?(CloudTrail)

三浦 悟

WRITTEN BY三浦 悟

re:Invent2013にて、CloudTrailの発表があったので触ってみました。

CloudTrailは、AWSのAPIコールの記録をS3にログとして保存するサービスです。
これによってセキュリティ分析や運用チェックなどを行うことが可能です。

AWSコンソールをみるとCoudTrailが追加されているので、開いてみます。


ログの保存先のS3バケットを指定して、必要であればその他のオプションも設定します。


Subscribeボタンを押すと、設定完了です。


しばらく、AWSの操作をしたあと、出力先に設定したS3バケットを確認します。
すると、以下のようにjson形式のログファイルが圧縮された状態で日ごとに保存されるようになります。


このうちの一つをダウンロードして中身を見てみます。


{
"Records": [
{
"awsRegion": "us-east-1",
"eventName": "DescribeRouteTables",
"eventSource": "ec2.amazonaws.com",
"eventTime": "2013-11-15T18:08:00Z",
"eventVersion": "1.0",
"requestParameters": {
"filterSet": {},
"routeTableIdSet": {}
},
"responseElements": "<responseOmitted>",
"sourceIPAddress": "54.249.240.229",
"userAgent": "aws-sdk-php/1.6.2 PHP/5.4.20 curl/7.19.7 openssl/1.0.0-fips",
"userIdentity": {
"accessKeyId": "xxxxxxxxxxxxxxxxxx",
"accountId": "821635308497",
"arn": "arn:aws:iam::821635308497:root",
"principalId": "821635308497",
"type": "Root"
}
},
{
"awsRegion": "us-east-1",
"eventName": "DescribeSubnets",
"eventSource": "ec2.amazonaws.com",
"eventTime": "2013-11-15T18:07:59Z",
"eventVersion": "1.0",
"requestParameters": {
"filterSet": {},
"subnetSet": {}
},
"responseElements": "<responseOmitted>",
"sourceIPAddress": "54.249.240.229",
"userAgent": "aws-sdk-php/1.6.2 PHP/5.4.20 curl/7.19.7 openssl/1.0.0-fips",
"userIdentity": {
"accessKeyId": "xxxxxxxxxxxxxxxxxx",
"accountId": "821635308497",
"arn": "arn:aws:iam::821635308497:root",
"principalId": "821635308497",
"type": "Root"
}
},
{
"awsRegion": "us-east-1",
"eventName": "DescribeVpcs",
"eventSource": "ec2.amazonaws.com",
"eventTime": "2013-11-15T18:07:58Z",
"eventVersion": "1.0",
"requestParameters": {
"filterSet": {},
"vpcSet": {}
},
"responseElements": "<responseOmitted>",
"sourceIPAddress": "54.249.240.229",
"userAgent": "aws-sdk-php/1.6.2 PHP/5.4.20 curl/7.19.7 openssl/1.0.0-fips",
"userIdentity": {
"accessKeyId": "xxxxxxxxxxxxxxxxxx",
"accountId": "821635308497",
"arn": "arn:aws:iam::821635308497:root",
"principalId": "821635308497",
"type": "Root"
}
},
{
"awsRegion": "us-east-1",
"eventName": "DescribeSecurityGroups",
"eventSource": "ec2.amazonaws.com",
"eventTime": "2013-11-15T18:08:03Z",
"eventVersion": "1.0",
"requestParameters": {
"filterSet": {},
"securityGroupIdSet": {},
"securityGroupSet": {}
},
"responseElements": "<responseOmitted>",
"sourceIPAddress": "54.249.240.229",
"userAgent": "aws-sdk-php/1.6.2 PHP/5.4.20 curl/7.19.7 openssl/1.0.0-fips",
"userIdentity": {
"accessKeyId": "xxxxxxxxxxxxxxxxxx",
"accountId": "821635308497",
"arn": "arn:aws:iam::821635308497:root",
"principalId": "821635308497",
"type": "Root"
}
},
{
"awsRegion": "us-east-1",
"eventName": "DescribeNetworkAcls",
"eventSource": "ec2.amazonaws.com",
"eventTime": "2013-11-15T18:08:01Z",
"eventVersion": "1.0",
"requestParameters": {
"filterSet": {},
"networkAclIdSet": {}
},
"responseElements": "<responseOmitted>",
"sourceIPAddress": "54.249.240.229",
"userAgent": "aws-sdk-php/1.6.2 PHP/5.4.20 curl/7.19.7 openssl/1.0.0-fips",
"userIdentity": {
"accessKeyId": "xxxxxxxxxxxxxxxxxx",
"accountId": "821635308497",
"arn": "arn:aws:iam::821635308497:root",
"principalId": "821635308497",
"type": "Root"
}
},
{
"awsRegion": "us-east-1",
"eventName": "DescribeDBInstances",
"eventSource": "rds.amazonaws.com",
"eventTime": "2013-11-15T18:08:06Z",
"eventVersion": "1.0",
"requestParameters": null,
"responseElements": null,
"sourceIPAddress": "54.249.240.229",
"userAgent": "aws-sdk-php/1.6.2 PHP/5.4.20 curl/7.19.7 openssl/1.0.0-fips",
"userIdentity": {
"accessKeyId": "xxxxxxxxxxxxxxxxxx",
"accountId": "821635308497",
"arn": "arn:aws:iam::821635308497:root",
"principalId": "821635308497",
"type": "Root"
}
},
{
"awsRegion": "us-east-1",
"eventName": "DescribeVolumes",
"eventSource": "ec2.amazonaws.com",
"eventTime": "2013-11-15T18:08:04Z",
"eventVersion": "1.0",
"requestParameters": {
"filterSet": {},
"volumeSet": {}
},
"responseElements": "<responseOmitted>",
"sourceIPAddress": "54.249.240.229",
"userAgent": "aws-sdk-php/1.6.2 PHP/5.4.20 curl/7.19.7 openssl/1.0.0-fips",
"userIdentity": {
"accessKeyId": "xxxxxxxxxxxxxxxxxx",
"accountId": "821635308497",
"arn": "arn:aws:iam::821635308497:root",
"principalId": "821635308497",
"type": "Root"
}
},
{
"awsRegion": "us-east-1",
"eventName": "DescribeAddresses",
"eventSource": "ec2.amazonaws.com",
"eventTime": "2013-11-15T18:08:03Z",
"eventVersion": "1.0",
"requestParameters": {
"allocationIdsSet": {},
"filterSet": {},
"publicIpsSet": {}
},
"responseElements": "<responseOmitted>",
"sourceIPAddress": "54.249.240.229",
"userAgent": "aws-sdk-php/1.6.2 PHP/5.4.20 curl/7.19.7 openssl/1.0.0-fips",
"userIdentity": {
"accessKeyId": "xxxxxxxxxxxxxxxxxx",
"accountId": "821635308497",
"arn": "arn:aws:iam::821635308497:root",
"principalId": "821635308497",
"type": "Root"
}
},
{
"awsRegion": "us-east-1",
"eventName": "DescribeInstances",
"eventSource": "ec2.amazonaws.com",
"eventTime": "2013-11-15T18:08:02Z",
"eventVersion": "1.0",
"requestParameters": {
"filterSet": {},
"instancesSet": {}
},
"responseElements": "<responseOmitted>",
"sourceIPAddress": "54.249.240.229",
"userAgent": "aws-sdk-php/1.6.2 PHP/5.4.20 curl/7.19.7 openssl/1.0.0-fips",
"userIdentity": {
"accessKeyId": "xxxxxxxxxxxxxxxxxx",
"accountId": "821635308497",
"arn": "arn:aws:iam::821635308497:root",
"principalId": "821635308497",
"type": "Root"
}
}
]
}

このように呼び出したAPIの内容が表示されるため、jqやログ解析ツールなどと併用してAWSアカウントに対して
どういった操作があったかを簡潔に知ることが可能になります。

以上です。

こちらの記事はなかの人(memorycraft)監修のもと掲載しています。
元記事は、こちら

三浦 悟

三浦 悟

高円寺在住のなんじゃ系男子 またの名をmemorycraftといいます。 炭水化物大好き 日々の「なんじゃ?」を記事にしてます。