1 個回答
- 最新
- 最多得票
- 最多評論
1
Using the AWS Console
- Open your Amazon CloudWatch console and specify a region.
- On the left hand menu, select Insights under Logs.
- Select your CloudTrail Logs group from the dropdown near the top.
- On the right, choose a relative time frame to search.
- Enter the following command into the query input, and click Run query:
filter errorCode like /Unauthorized|Denied|Forbidden/ | fields awsRegion,
userIdentity.arn, eventSource, eventName, sourceIPAddress, userAgent
You could do the same with Athena from your S3 bucket trail
Information source https://www.blinkops.com/blog/getting-a-list-of-accessdenied-events-with-users-and-source-ip-addresses
相關內容
- AWS 官方已更新 10 個月前