2013年11月16日土曜日

re:Inventってなんじゃ?(CloudTrail)

re:Invent2013に来ています。
そこでCloudTrailの発表があったので触ってみました。

CloudTrailは、AWSのAPIコールの記録をS3にログとして保存するサービスです。
これによってセキュリティ分析や運用チェックなどを行うことが可能です。

AWSコンソールをみるとCoudTrailが追加されているので、開いてみます。


ログの保存先のS3バケットを指定して、必要であればその他のオプションも設定します。


Subscribeボタンを押すと、設定完了です。



しばらく、AWSの操作をしたあと、出力先に設定したS3バケットを確認します。
すると、以下のように、json形式のログファイルが圧縮された状態で日ごとに保存されるようになります。



このうちの一つをダウンロードして中身を見てみます。

{
    "Records": [
        {
            "awsRegion": "us-east-1", 
            "eventName": "DescribeRouteTables", 
            "eventSource": "ec2.amazonaws.com", 
            "eventTime": "2013-11-15T18:08:00Z", 
            "eventVersion": "1.0", 
            "requestParameters": {
                "filterSet": {}, 
                "routeTableIdSet": {}
            }, 
            "responseElements": "<responseOmitted>", 
            "sourceIPAddress": "54.249.240.229", 
            "userAgent": "aws-sdk-php/1.6.2 PHP/5.4.20 curl/7.19.7 openssl/1.0.0-fips", 
            "userIdentity": {
                "accessKeyId": "xxxxxxxxxxxxxxxxxx", 
                "accountId": "821635308497", 
                "arn": "arn:aws:iam::821635308497:root", 
                "principalId": "821635308497", 
                "type": "Root"
            }
        }, 
        {
            "awsRegion": "us-east-1", 
            "eventName": "DescribeSubnets", 
            "eventSource": "ec2.amazonaws.com", 
            "eventTime": "2013-11-15T18:07:59Z", 
            "eventVersion": "1.0", 
            "requestParameters": {
                "filterSet": {}, 
                "subnetSet": {}
            }, 
            "responseElements": "<responseOmitted>", 
            "sourceIPAddress": "54.249.240.229", 
            "userAgent": "aws-sdk-php/1.6.2 PHP/5.4.20 curl/7.19.7 openssl/1.0.0-fips", 
            "userIdentity": {
                "accessKeyId": "xxxxxxxxxxxxxxxxxx", 
                "accountId": "821635308497", 
                "arn": "arn:aws:iam::821635308497:root", 
                "principalId": "821635308497", 
                "type": "Root"
            }
        }, 
        {
            "awsRegion": "us-east-1", 
            "eventName": "DescribeVpcs", 
            "eventSource": "ec2.amazonaws.com", 
            "eventTime": "2013-11-15T18:07:58Z", 
            "eventVersion": "1.0", 
            "requestParameters": {
                "filterSet": {}, 
                "vpcSet": {}
            }, 
            "responseElements": "<responseOmitted>", 
            "sourceIPAddress": "54.249.240.229", 
            "userAgent": "aws-sdk-php/1.6.2 PHP/5.4.20 curl/7.19.7 openssl/1.0.0-fips", 
            "userIdentity": {
                "accessKeyId": "xxxxxxxxxxxxxxxxxx", 
                "accountId": "821635308497", 
                "arn": "arn:aws:iam::821635308497:root", 
                "principalId": "821635308497", 
                "type": "Root"
            }
        }, 
        {
            "awsRegion": "us-east-1", 
            "eventName": "DescribeSecurityGroups", 
            "eventSource": "ec2.amazonaws.com", 
            "eventTime": "2013-11-15T18:08:03Z", 
            "eventVersion": "1.0", 
            "requestParameters": {
                "filterSet": {}, 
                "securityGroupIdSet": {}, 
                "securityGroupSet": {}
            }, 
            "responseElements": "<responseOmitted>", 
            "sourceIPAddress": "54.249.240.229", 
            "userAgent": "aws-sdk-php/1.6.2 PHP/5.4.20 curl/7.19.7 openssl/1.0.0-fips", 
            "userIdentity": {
                "accessKeyId": "xxxxxxxxxxxxxxxxxx", 
                "accountId": "821635308497", 
                "arn": "arn:aws:iam::821635308497:root", 
                "principalId": "821635308497", 
                "type": "Root"
            }
        }, 
        {
            "awsRegion": "us-east-1", 
            "eventName": "DescribeNetworkAcls", 
            "eventSource": "ec2.amazonaws.com", 
            "eventTime": "2013-11-15T18:08:01Z", 
            "eventVersion": "1.0", 
            "requestParameters": {
                "filterSet": {}, 
                "networkAclIdSet": {}
            }, 
            "responseElements": "<responseOmitted>", 
            "sourceIPAddress": "54.249.240.229", 
            "userAgent": "aws-sdk-php/1.6.2 PHP/5.4.20 curl/7.19.7 openssl/1.0.0-fips", 
            "userIdentity": {
                "accessKeyId": "xxxxxxxxxxxxxxxxxx", 
                "accountId": "821635308497", 
                "arn": "arn:aws:iam::821635308497:root", 
                "principalId": "821635308497", 
                "type": "Root"
            }
        }, 
        {
            "awsRegion": "us-east-1", 
            "eventName": "DescribeDBInstances", 
            "eventSource": "rds.amazonaws.com", 
            "eventTime": "2013-11-15T18:08:06Z", 
            "eventVersion": "1.0", 
            "requestParameters": null, 
            "responseElements": null, 
            "sourceIPAddress": "54.249.240.229", 
            "userAgent": "aws-sdk-php/1.6.2 PHP/5.4.20 curl/7.19.7 openssl/1.0.0-fips", 
            "userIdentity": {
                "accessKeyId": "xxxxxxxxxxxxxxxxxx", 
                "accountId": "821635308497", 
                "arn": "arn:aws:iam::821635308497:root", 
                "principalId": "821635308497", 
                "type": "Root"
            }
        }, 
        {
            "awsRegion": "us-east-1", 
            "eventName": "DescribeVolumes", 
            "eventSource": "ec2.amazonaws.com", 
            "eventTime": "2013-11-15T18:08:04Z", 
            "eventVersion": "1.0", 
            "requestParameters": {
                "filterSet": {}, 
                "volumeSet": {}
            }, 
            "responseElements": "<responseOmitted>", 
            "sourceIPAddress": "54.249.240.229", 
            "userAgent": "aws-sdk-php/1.6.2 PHP/5.4.20 curl/7.19.7 openssl/1.0.0-fips", 
            "userIdentity": {
                "accessKeyId": "xxxxxxxxxxxxxxxxxx", 
                "accountId": "821635308497", 
                "arn": "arn:aws:iam::821635308497:root", 
                "principalId": "821635308497", 
                "type": "Root"
            }
        }, 
        {
            "awsRegion": "us-east-1", 
            "eventName": "DescribeAddresses", 
            "eventSource": "ec2.amazonaws.com", 
            "eventTime": "2013-11-15T18:08:03Z", 
            "eventVersion": "1.0", 
            "requestParameters": {
                "allocationIdsSet": {}, 
                "filterSet": {}, 
                "publicIpsSet": {}
            }, 
            "responseElements": "<responseOmitted>", 
            "sourceIPAddress": "54.249.240.229", 
            "userAgent": "aws-sdk-php/1.6.2 PHP/5.4.20 curl/7.19.7 openssl/1.0.0-fips", 
            "userIdentity": {
                "accessKeyId": "xxxxxxxxxxxxxxxxxx", 
                "accountId": "821635308497", 
                "arn": "arn:aws:iam::821635308497:root", 
                "principalId": "821635308497", 
                "type": "Root"
            }
        }, 
        {
            "awsRegion": "us-east-1", 
            "eventName": "DescribeInstances", 
            "eventSource": "ec2.amazonaws.com", 
            "eventTime": "2013-11-15T18:08:02Z", 
            "eventVersion": "1.0", 
            "requestParameters": {
                "filterSet": {}, 
                "instancesSet": {}
            }, 
            "responseElements": "<responseOmitted>", 
            "sourceIPAddress": "54.249.240.229", 
            "userAgent": "aws-sdk-php/1.6.2 PHP/5.4.20 curl/7.19.7 openssl/1.0.0-fips", 
            "userIdentity": {
                "accessKeyId": "xxxxxxxxxxxxxxxxxx", 
                "accountId": "821635308497", 
                "arn": "arn:aws:iam::821635308497:root", 
                "principalId": "821635308497", 
                "type": "Root"
            }
        }
    ]
}


このように呼び出したAPIの内容が表示されるため、jqやログ解析ツールなどと併用してAWSアカウントに対してどういった操作があったかを簡潔に知ることが可能になります。

以上です。