- Le plus récent
- Le plus de votes
- La plupart des commentaires
You're on the right track. Any time a role is assumed, the API call is stored in CloudTrail. Try looking back in CloudTrail for any events named AssumeRole. If you have multiple users/accounts assuming multiple roles throughout the day, you may have to dig through a few events to find the one(s) from LucidScale. I've pasted an example CloudTrail log below of a user named 'jsmith' assuming a role so you can see sort of what you're looking for and what information is included.
{
"version": "0",
"id": "c204c067-a376-47a8-a760-f0bf97b89aae",
"detail-type": "AWS API Call via CloudTrail",
"source": "aws.sts",
"account": "1111111111111",
"time": "2016-04-05T20:39:37Z",
"region": "us-east-1",
"resources": [],
"detail": {
"eventVersion": "1.04",
"userIdentity": {
"type": "IAMUser",
"principalId": "AIDAIDVUOOO7V6R6HKL6E",
"arn": "arn:aws:iam::1111111111111:user/jsmith",
"accountId": "1111111111111",
"accessKeyId": "AKIAJ2DZP3QVQ3D6VJBQ",
"userName": "jsmith"
},
"eventTime": "2016-04-05T20:39:37Z",
"eventSource": "sts.amazonaws.com",
"eventName": "AssumeRole",
"awsRegion": "global",
"sourceIPAddress": "72.21.196.66",
Once you have this information, you can use EventBridge to create a rule to send an alert to an SNS topic any time that role is assumed. More info here. The rule would look something like this, assuming that the account Lucid is assuming the role with is 111111111111:
{
"source": ["aws.cloudtrail"],
"detail-type": ["AWS API Call via CloudTrail"],
"detail": {
"eventSource": ["cloudtrail.amazonaws.com"],
"eventName": ["AssumeRole"],
"accountid": ["1111111111111"]
}
}
Using this method, you can get an email, text, or even Slack notification anytime the role is assumed. One thing to note is CloudTrail is not real time, so when receive the alert there could have been up to a 15 minute delay since the role was actually assumed. Hope this helps!
Contenus pertinents
- demandé il y a un an
- demandé il y a 6 mois
- demandé il y a un an
- AWS OFFICIELA mis à jour il y a 2 ans
- Comment connecter différentes succursales à l'aide de AWS Site-to-Site VPN et d'AWS Direct Connect ?AWS OFFICIELA mis à jour il y a un an
- AWS OFFICIELA mis à jour il y a 2 ans
- AWS OFFICIELA mis à jour il y a un an