如何建立 EventBridge 事件規則以通知有人使用我的 AWS 根使用者帳戶?

3 分的閱讀內容
0

我想在有人使用我的 AWS 根使用者帳戶時收到通知。

解決方法

啟動 AWS CloudFormation 堆疊以建立 Amazon Simple Notification Service (Amazon SNS) 主題。然後,建立 Amazon EventBridge 事件規則,以從 AWS 管理主控台監控 userIdentity 根登入。

重要:在開始之前,請務必將 AWS CloudTrail 管理讀取和寫入事件設定為全部唯寫。這可讓 EventBridge 事件發起登入事件通知。如需詳細資訊,請參閱讀取和寫入事件

  1. 將此 YAML 範本複製並貼到您最愛的編輯器工具中,然後儲存:

    # Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.
    # Permission is hereby granted, free of charge, to any person obtaining a copy of this
    # software and associated documentation files (the "Software"), to deal in the Software
    # without restriction, including without limitation the rights to use, copy, modify,
    # merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
    # permit persons to whom the Software is furnished to do so.
    #
    # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
    # INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
    # PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
    # HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
    # OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
    # SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
    
    AWSTemplateFormatVersion: '2010-09-09'
    Description: ROOT-AWS-Console-Sign-In-via-CloudTrail
    Metadata:
      AWS::CloudFormation::Interface:
        ParameterGroups:
        - Label:
            default: Amazon SNS parameters
          Parameters:
          - Email Address
    Parameters:
      EmailAddress:
        Type: String
        ConstraintDescription: Email address required.
        Description: Enter an email address you want to subscribe to the Amazon SNS topic
          that will send notifications if your account's AWS root user logs in.
    Resources:
      RootActivitySNSTopic:
        Type: AWS::SNS::Topic
        Properties:
          DisplayName: ROOT-AWS-Console-Sign-In-via-CloudTrail
          Subscription:
          - Endpoint:
              Ref: EmailAddress
            Protocol: email
          TopicName: ROOT-AWS-Console-Sign-In-via-CloudTrail
      EventsRule:
        Type: AWS::Events::Rule
        Properties:
          Description: Events rule for monitoring root AWS Console Sign In activity
          EventPattern:
            detail-type:
            - AWS Console Sign In via CloudTrail
            detail:
              userIdentity:
                type:
                - Root
          Name:
            Fn::Sub: "${AWS::StackName}-RootActivityRule"
          State: ENABLED
          Targets:
          - Arn:
              Ref: RootActivitySNSTopic
            Id: RootActivitySNSTopic
        DependsOn:
        - RootActivitySNSTopic
      RootPolicyDocument:
        Type: AWS::SNS::TopicPolicy
        Properties:
          PolicyDocument:
            Id: RootPolicyDocument
            Version: '2012-10-17'
            Statement:
            - Sid: RootPolicyDocument
              Effect: Allow
              Principal:
                Service: events.amazonaws.com
              Action: sns:Publish
              Resource:
              - Ref: RootActivitySNSTopic
          Topics:
          - Ref: RootActivitySNSTopic
    Outputs:
      EventsRule:
        Value:
          Ref: EventsRule
        Export:
          Name:
            Fn::Sub: "${AWS::StackName}-RootAPIMonitorEventsRule"
        Description: Event Rule ID.
  2. 在美國東部 (維吉尼亞北部) 區域開啟 CloudFormation 主控台,然後選擇建立堆疊

    注意: 您必須在美國東部 (維吉尼亞北部) 區域中建立 CloudFormation 堆疊。

  3. 選擇建立堆疊,然後選擇使用新資源 (標準)

  4. 選擇上傳範本檔案下一步選擇檔案

  5. 選擇您在步驟 1 中儲存的範本,然後選擇下一步

  6. 堆疊名稱中,輸入對您有意義的名稱,例如 Root-AWS-Console-Sign-In-CloudTrail

  7. EmailAddress 中,輸入您的電郵地址,然後選擇下一步
    注意: AWS 會將確認電子郵件傳送到此電子郵件地址。

  8. 選項中選擇下一步,然後選擇建立

  9. 檢查您的電子郵件收件匣是否有 AWS 確認電子郵件,然後選擇確認訂閱確認 SNS 訂閱請求。您將收到**訂閱已確認!**訊息。

  10. 若要測試通知,請登出 AWS 管理主控台。然後,使用您的 AWS 根使用者帳戶登入 AWS 管理主控台

  11. 檢查您的電子郵件收件匣是否有 AWS 通知訊息。記下包含登入事件詳細資訊的 CloudTrail 記錄 userIdentitysourceIPAddressMFAUsed

如果您不想收到通知,請刪除您在步驟 2 中建立的 CloudFormation 堆疊

相關資訊

在 AWS CloudFormation 主控台建立堆疊

如何在使用 AWS 帳戶的根存取金鑰時接收通知

監控和通知 AWS 帳戶根使用者活動

AWS::CloudWatch::Alarm

AWS 官方
AWS 官方已更新 5 個月前