Movatterモバイル変換

[0]ホーム
URL:

Logging AWS Backup API calls with CloudTrail - AWS Backup
DocumentationAWS BackupDeveloper Guide
AWS Backup events in CloudTrailUnderstanding AWS Backup log file entriesLogging cross-account management events

Logging AWS Backup API calls with CloudTrail

AWS Backup is integrated withAWS CloudTrail a service that provides a record of actions taken by a user, role, or an AWS service service. CloudTrail captures all API calls for AWS Backup as events. The calls captured include calls from the AWS Backup console and code calls to the AWS Backup API operations. Using the information collected by CloudTrail, you can determine the request that was made to AWS Backup, the IP address from which the request was made, when it was made, and additional details.

Every event or log entry contains information about who generated the request. The identity information helps you determine the following:

  • Whether the request was made with root user or user credentials.

  • Whether the request was made on behalf of an IAM Identity Center user.

  • Whether the request was made with temporary security credentials for a role or federated user.

  • Whether the request was made by another AWS service.

CloudTrail is active in your AWS account when you create the account and you automatically have access to the CloudTrailEvent history. The CloudTrailEvent history provides a viewable, searchable, downloadable, and immutable record of the past 90 days of recorded management events in an AWS Region. For more information, seeWorking with CloudTrail Event history in theAWS CloudTrail User Guide. There are no CloudTrail charges for viewing theEvent history.

For an ongoing record of events in your AWS account past 90 days, create a trail or aCloudTrail Lake event data store.

CloudTrail trails

Atrail enables CloudTrail to deliver log files to an Amazon S3 bucket. All trails created using the AWS Management Console are multi-Region. You can create a single-Region or a multi-Region trail by using the AWS CLI. Creating a multi-Region trail is recommended because you capture activity in all AWS Regions in your account. If you create a single-Region trail, you can view only the events logged in the trail's AWS Region. For more information about trails, seeCreating a trail for your AWS account andCreating a trail for an organization in theAWS CloudTrail User Guide.

You can deliver one copy of your ongoing management events to your Amazon S3 bucket at no charge from CloudTrail by creating a trail, however, there are Amazon S3 storage charges. For more information about CloudTrail pricing, seeAWS CloudTrail Pricing. For information about Amazon S3 pricing, seeAmazon S3 Pricing.

CloudTrail Lake event data stores

CloudTrail Lake lets you run SQL-based queries on your events. CloudTrail Lake converts existing events in row-based JSON format to Apache ORC format. ORC is a columnar storage format that is optimized for fast retrieval of data. Events are aggregated intoevent data stores, which are immutable collections of events based on criteria that you select by applyingadvanced event selectors. The selectors that you apply to an event data store control which events persist and are available for you to query. For more information about CloudTrail Lake, seeWorking with AWS CloudTrail Lake in theAWS CloudTrail User Guide.

CloudTrail Lake event data stores and queries incur costs. When you create an event data store, you choose thepricing option you want to use for the event data store. The pricing option determines the cost for ingesting and storing events, and the default and maximum retention period for the event data store. For more information about CloudTrail pricing, seeAWS CloudTrail Pricing.

AWS Backup events in CloudTrail

AWS Backup generates these CloudTrail events when it performs backups, restores, copies, scans or notifications. These events are not necessarily generated by use of the AWS Backup public APIs. For more information, seeAWS service events in theAWS CloudTrail User Guide.

  • AssociateBackupVaultMpaApprovalTeamCompleted

  • AssociateBackupVaultMpaApprovalTeamFailed

  • BackupDeleted

  • BackupJobCompleted

  • BackupJobStarted

  • BackupSelectionDeletedDueToSLRDeletion

  • BackupTransitionedToCold

  • CopyJobCompleted

  • CopyJobStarted

  • CreateRestoreAccessBackupVaultFailed

  • DisassociateBackupVaultMpaApprovalTeamFailed

  • PutBackupVaultNotifications

  • RecoveryPointCreated

  • ReportJobCompleted

  • ReportJobStarted

  • RestoreAccessBackupVaultDeleted

  • RestoreCompleted

  • RestoreStarted

  • RevokeRestoreAccessBackupVaultFailed

  • ScanJobCompleted

  • ScanJobCreated

  • ScanJobFailed

  • ScanJobStarted

Understanding AWS Backup log file entries

A trail is a configuration that enables delivery of events as log files to an Amazon S3 bucket that you specify. CloudTrail log files contain one or more log entries. An event represents a single request from any source and includes information about the requested action, the date and time of the action, request parameters, and so on. CloudTrail log files aren't an ordered stack trace of the public API calls, so they don't appear in any specific order.

The following example shows a CloudTrail log entry that demonstrates theStartBackupJob,StartRestoreJob, andDeleteRecoveryPoint actions and also theBackupJobCompleted event.

{    "eventVersion": "1.05",    "userIdentity":{        "type": "Root",        "principalId": "123456789012",        "arn": "arn:aws:iam::123456789012:root",        "accountId": "123456789012",        "accessKeyId": "AKIAI44QH8DHBEXAMPLE",        "sessionContext":{            "attributes":{                "mfaAuthenticated": "false",                "creationDate": "2019-01-10T12:24:50Z"            }        }    },    "eventTime": "2019-01-10T13:45:24Z",    "eventSource": "backup.amazonaws.com",    "eventName": "StartBackupJob",    "awsRegion": "us-east-1",    "sourceIPAddress": "12.34.567.89",    "userAgent": "aws-internal/3 aws-sdk-java/1.11.465 Linux/4.9.124-0.1.ac.198.73.329.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.192-b12 java/1.8.0_192",    "requestParameters":{        "backupVaultName": "Default",        "resourceArn": "arn:aws:ec2:us-east-1:123456789012:volume/vol-00a422a05b9c6asd3",        "iamRoleArn": "arn:aws:iam::123456789012:role/AWSBackup",        "startWindowMinutes": 60    },    "responseElements":{        "backupJobId": "8a3c2a87-b23e-4d56-b045-fa9e88ede4e6",        "creationDate": "Jan 10, 2019 1:45:24 PM"    },    "requestID": "98cf4d59-8c76-49f7-9201-790743931234",    "eventID": "fe8146a5-7812-4a95-90ad-074498be1234",    "eventType": "AwsApiCall",    "recipientAccountId": "account-id"},{    "eventVersion": "1.05",    "userIdentity":{        "type": "Root",        "principalId": "123456789012",        "arn": "arn:aws:iam::123456789012:root",        "accountId": "123456789012",        "accessKeyId": "AKIAI44QH8DHBEXAMPLE",        "sessionContext":{            "attributes":{                "mfaAuthenticated": "false",                "creationDate": "2019-01-10T12:24:50Z"            }        }    },    "eventTime": "2019-01-10T13:49:50Z",    "eventSource": "backup.amazonaws.com",    "eventName": "StartRestoreJob",    "awsRegion": "us-east-1",    "sourceIPAddress": "12.34.567.89",    "userAgent": "aws-internal/3 aws-sdk-java/1.11.465 Linux/4.9.124-0.1.ac.198.73.329.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.192-b12 java/1.8.0_192",    "requestParameters":{        "recoveryPointArn": "arn:aws:ec2:us-east-1::snapshot/snap-00a129455bdbc9d99",        "metadata":{            "volumeType": "gp2",            "availabilityZone": "us-east-1b",            "volumeSize": "100"        },        "iamRoleArn": "arn:aws:iam::123456789012:role/AWSBackup",        "idempotencyToken": "a9c8b4fb-d369-4a58-944b-942e442a8fe3",        "resourceType": "EBS"    },    "responseElements":{        "restoreJobId": "9808E090-8C76-CCB8-4CEA-407CF6AC4C43"    },    "requestID": "783ddddc-6d7e-4539-8fab-376aa9668543",    "eventID": "ff35ddea-7577-4aec-a132-964b7e9dd423",    "eventType": "AwsApiCall",    "recipientAccountId": "account-id"},{    "eventVersion": "1.05",    "userIdentity":{        "type": "Root",        "principalId": "123456789012",        "arn": "arn:aws:iam::123456789012:root",        "accountId": "123456789012",        "accessKeyId": "AKIAI44QH8DHBEXAMPLE",        "sessionContext":{            "attributes":{                "mfaAuthenticated": "false",                "creationDate": "2019-01-10T12:24:50Z"            }        }    },    "eventTime": "2019-01-10T14:52:42Z",    "eventSource": "backup.amazonaws.com",    "eventName": "DeleteRecoveryPoint",    "awsRegion": "us-east-1",    "sourceIPAddress": "12.34.567.89",    "userAgent": "aws-internal/3 aws-sdk-java/1.11.465 Linux/4.9.124-0.1.ac.198.73.329.metal1.x86_64 OpenJDK_64-Bit_Server_VM/25.192-b12 java/1.8.0_192",    "requestParameters":{        "backupVaultName": "Default",        "recoveryPointArn": "arn:aws:ec2:us-east-1::snapshot/snap-05f426fd9daab3433"    },    "responseElements": null,    "requestID": "f1f1b33a-48da-436c-9a8f-7574f1ab5fd7",    "eventID": "2dd70080-5aba-4a79-9a0f-92647c9f0846",    "eventType": "AwsApiCall",    "recipientAccountId": "account-id"},{    "eventVersion": "1.05",    "userIdentity":{        "accountId": "123456789012",        "invokedBy": "backup.amazonaws.com"    },    "eventTime": "2019-01-10T08:24:39Z",    "eventSource": "backup.amazonaws.com",    "eventName": "BackupJobCompleted",    "awsRegion": "us-east-1",    "sourceIPAddress": "backup.amazonaws.com",    "userAgent": "backup.amazonaws.com",    "requestParameters": null,    "responseElements": null,    "eventID": "2e7e4fcf-0c52-467f-9fd0-f61c2fcf7d17",    "eventType": "AwsServiceEvent",    "recipientAccountId": "account-id",    "serviceEventDetails":{        "completionDate":{            "seconds": 1547108091,            "nanos": 906000000        },        "state": "COMPLETED",        "percentDone": 100,        "backupJobId": "8A8E738B-A8C5-E058-8224-90FA323A3C0E",        "backupVaultName": "BackupVault",        "backupVaultArn": "arn:aws:backup:us-east-1:123456789012:backup-vault:BackupVault",        "recoveryPointArn": "arn:aws:ec2:us-east-1::snapshot/snap-07ce8c3141d361233",        "resourceArn": "arn:aws:ec2:us-east-1:123456789012:volume/vol-06692095a6a421233",        "creationDate":{            "seconds": 1547101638,            "nanos": 272000000        },        "backupSizeInBytes": 8589934592,        "iamRoleArn": "arn:aws:iam::123456789012:role/AWSBackup",        "resourceType": "EBS"    }}

Logging cross-account management events

With AWS Backup, you can manage your backups across all AWS accounts inside yourAWS Organizations structure. AWS Backup generates these CloudTrail events in your member account when you create, update, or delete an AWS Organizations backup policy (that applies backup plans to your member accounts) or when there is an invalid organization backup plan:

  • CreateOrganizationalBackupPlan

  • UpdateOrganizationalBackupPlan

  • DeleteOrganizationalBackupPlan

  • InvalidOrganizationBackupPlan

Example: AWS Backup log file entries for cross-account management

A trail is a configuration that enables delivery of events as log files to an Amazon S3 bucket that you specify. CloudTrail log files contain one or more log entries. An event represents a single request from any source and includes information about the requested action, the date and time of the action, request parameters, and so on. CloudTrail log files aren't an ordered stack trace of the public API calls, so they don't appear in any specific order.

The following example shows a CloudTrail log entry that demonstrates theCreateOrganizationalBackupPlan action.

{    "eventVersion": "1.05",    "userIdentity":{        "accountId": "123456789012",        "invokedBy": "backup.amazonaws.com"},    "eventTime": "2020-06-02T00:34:00Z",    "eventSource": "backup.amazonaws.com",    "eventName": "CreateOrganizationalBackupPlan",    "awsRegion": "ca-central-1",    "sourceIPAddress": "backup.amazonaws.com",    "userAgent": "backup.amazonaws.com",    "requestParameters": null,    "responseElements": null,    "eventID": "f2642255-af77-4203-8c37-7ca19d898e84",    "readOnly": false,    "eventType": "AwsServiceEvent",    "recipientAccountId": "account-id",    "serviceEventDetails":{        "backupPlanId": "orgs/544033d1-b19c-3f2a-9c20-40bcfa82ca68",        "backupPlanVersionId": "ZTA1Y2ZjZDYtNmRjMy00ZTA1LWIyNTAtM2M1NzQ4OThmNzRj",        "backupPlanArn": "arn:aws:backup:ca-central-1:123456789012:backup-plan:orgs/544033d1-b19c-3f2a-9c20-40bcfa82ca68",        "backupPlanName": "mybackupplan",        "backupRules": "[{\"id\":\"745fd0ea-7f57-3f35-8a0e-ed4b8c48a8e2\",\"name\":\"hourly\",\"description\":null,\"cryopodArn\":\"arn:aws:backup:ca-central-1:123456789012:backup-vault:ControllerCAMTestBackupVault\",\"scheduleExpression\":\"cron(0 0/1 ? * * *)\",\"startWindow\":\"PT1H\",\"completionWindow\":\"PT2H\",\"lifecycle\":{\"moveToColdStorageAfterDays\":null,\"deleteAfterDays\":\"7\"},\"tags\":null,\"copyActions\":[]}]",        "backupSelections": "[{\"name\":\"selectiondatatype\",\"arn\":\"arn:aws:backup:ca-central-1:123456789012:selection:8b40c6d9-3641-3d49-926d-a075ea715686\",\"role\":\"arn:aws:iam::123456789012:role/OrganizationmyRoleTestRole\",\"resources\":[],\"notResources\":[],\"conditions\":[{\"type\":\"STRINGEQUALS\",\"key\":\"dataType\",\"value\":\"PII\"},{\"type\":\"STRINGEQUALS\",\"key\":\"dataType\",\"value\":\"RED\"}],\"creationDate\":\"2020-06-02T00:34:00.695Z\",\"creatorRequestId\":null}]",        "creationDate":{            "seconds": 1591058040,            "nanos": 695000000        },        "organizationId": "org-id",        "accountId": "123456789012"    }}

The following example shows a CloudTrail log entry that demonstrates theDeleteOrganizationalBackupPlan action.

{    "eventVersion": "1.05",    "userIdentity":{        "accountId": "123456789012",        "invokedBy": "backup.amazonaws.com"    },    "eventTime": "2020-06-02T00:34:25Z",    "eventSource": "backup.amazonaws.com",    "eventName": "DeleteOrganizationalBackupPlan",    "awsRegion": "ca-central-1",    "sourceIPAddress": "backup.amazonaws.com",    "userAgent": "backup.amazonaws.com",    "requestParameters": null,    "responseElements": null,    "eventID": "5ce66cd0-b90c-4957-8e00-96ea1077b4fa",    "readOnly": false,    "eventType": "AwsServiceEvent",    "recipientAccountId": "account-id",    "serviceEventDetails":{        "backupPlanId": "orgs/544033d1-b19c-3f2a-9c20-40bcfa82ca68",        "backupPlanVersionId": "ZTA1Y2ZjZDYtNmRjMy00ZTA1LWIyNTAtM2M1NzQ4OThmNzRj",        "backupPlanArn": "arn:aws:backup:ca-central-1:123456789012:backup-plan:orgs/544033d1-b19c-3f2a-9c20-40bcfa82ca68",        "backupPlanName": "mybackupplan",        "deletionDate":{            "seconds": 1591058065,            "nanos": 519000000        },        "organizationId": "org-id",        "accountId": "123456789012"    }}

The following example shows a CloudTrail log entry that demonstrates the eventInvalidOrganizationBackupPlan, which is sent when AWS Backup receives an invalid backup plan from Organizations.

{    "eventVersion": "1.08",    "userIdentity":{        "accountId": "123456789012",        "invokedBy": "backup.amazonaws.com"    },    "eventTime": "2022-06-11T13:29:23Z",    "eventSource": "backup.amazonaws.com",    "eventName": "InvalidOrganizationBackupPlan",    "awsRegion": "Region",    "sourceIPAddress": "backup.amazonaws.com",    "userAgent": "backup.amazonaws.com",    "requestParameters": null,    "responseElements": null,    "eventID": "ab1de234-fg56-7890-h123-45ij678k9l01",    "readOnly": false,    "eventType": "AwsServiceEvent",    "managementEvent": true,    "recipientAccountId": "987654321098",    "serviceEventDetails":{        "effectivePolicyVersion": 7,        "effectivePolicyId": "12345678-a9b0-123c-45d6-78e901f23456",        "lastUpdatedTimestamp": "Jun 11, 2022 1:29:22 PM",        "policyType": "BACKUP_POLICY",        "effectiveBackupPlan":{            "logicalName": "logical-name",            "regions": [                "Region"            ],            "rules": [{                    "name": "test-orgs",                    "targetBackupVaultName": "vault-name",                    "ruleLifecycle":{                        "deleteAfterDays": 100                    },                    "copyActions": [],                    "enableContinuousBackup": true                }            ],            "selections":{                "tagSelections": [{                        "selectionName": "selection-name",                        "iamRoleArn": "arn:aws:iam::$account:role/role",                        "targetedTags": [{                                "tagKey": "key",                                "tagValue": "value"                            }                        ]                    }                ]            },            "backupPlanTags":{                "key": "value"            }        },        "organizationId": "org-id",        "accountId": "123456789012"    },    "eventCategory": "Management"}
AWS Backup metrics with Amazon CloudWatch
Notification options with AWS Backup
[8]ページ先頭
©2009-2025 Movatter.jp