amazon-web-services - 让 Cloudwatch 将 CreateLogGroup 消息发送到 EventBridge

Question

我希望 CloudWatch 将 CreateLogGroup 消息发送到 EventBridge。

我知道这是可能的，但 Cloudwatch 似乎默认情况下不会发送这些消息。看来您必须配置 CloudTrail 才能让它转发消息。但我找不到有效的 CloudTrail 配置 - 一般情况下部署失败:AWS::CloudTrail::Trail - “提供的请求无效:检测到存储桶的 S3 存储桶策略不正确”

AWSTemplateFormatVersion: '2010-09-09'
Outputs:
  HelloFunction:
    Value:
      Ref: HelloFunction
  WatcherFunction:
    Value:
      Ref: WatcherFunction
  WatcherTrailBucket:
    Value:
      Ref: WatcherTrailBucket
Parameters:
  MemorySizeDefault:
    Default: '512'
    Type: String
  RuntimeVersion:
    Default: '3.8'
    Type: String
  TimeoutDefault:
    Default: '5'
    Type: String
Resources:
  HelloFunction:
    Properties:
      Code:
        ZipFile: |
          def handler(event, context):
              print (event)
      Handler: index.handler
      MemorySize:
        Ref: MemorySizeDefault
      Role:
        Fn::GetAtt:
        - HelloFunctionRole
        - Arn
      Runtime:
        Fn::Sub: python${RuntimeVersion}
      Timeout:
        Ref: TimeoutDefault
    Type: AWS::Lambda::Function
  HelloFunctionRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
        Version: '2012-10-17'
      Policies:
      - PolicyDocument:
          Statement:
          - Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Effect: Allow
            Resource: '*'
          Version: '2012-10-17'
        PolicyName:
          Fn::Sub: hello-function-role-policy-${AWS::StackName}
    Type: AWS::IAM::Role
  WatcherFunction:
    Properties:
      Code:
        ZipFile: |
          def handler(event, context):
              print (event)
      Handler: index.handler
      MemorySize:
        Ref: MemorySizeDefault
      Role:
        Fn::GetAtt:
        - WatcherFunctionRole
        - Arn
      Runtime:
        Fn::Sub: python${RuntimeVersion}
      Timeout:
        Ref: TimeoutDefault
    Type: AWS::Lambda::Function
  WatcherFunctionRole:
    Properties:
      AssumeRolePolicyDocument:
        Statement:
        - Action: sts:AssumeRole
          Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
        Version: '2012-10-17'
      Policies:
      - PolicyDocument:
          Statement:
          - Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
            Effect: Allow
            Resource: '*'
          Version: '2012-10-17'
        PolicyName:
          Fn::Sub: watcher-function-role-policy-${AWS::StackName}
    Type: AWS::IAM::Role
  WatcherEventRule:
    Type: AWS::Events::Rule
    Properties:
      EventPattern:
        source:
          - aws.logs
        detail-type:
          - "AWS API Call via CloudTrail"
        detail:
          eventName:
            - CreateLogGroup
      Targets:
      - Id:
          Fn::Sub: watcher-event-rule-${AWS::StackName}
        Arn:
          Fn::GetAtt:
          - WatcherFunction
          - Arn
      State: ENABLED
  WatcherEventRulePermission:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      Principal: events.amazonaws.com
      FunctionName:
        Ref: WatcherFunction
      SourceArn:
        Fn::GetAtt:
        - WatcherEventRule
        - Arn
  WatcherTrailBucket:
    Type: AWS::S3::Bucket
  WatcherTrailBucketPolicy:
    DependsOn:
    - WatcherTrailBucket
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
         Ref: WatcherTrailBucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: cloudtrail.amazonaws.com
            Action: s3:GetBucketAcl
            Resource: "*"
            Condition: {}
          - Effect: Allow
            Principal:
              Service: cloudtrail.amazonaws.com
            Action: s3:PutObject
            Resource: "*"
            Condition:
              StringEquals:
                s3:x-amz-acl: bucket-owner-full-control
  WatcherTrail:
    Type: AWS::CloudTrail::Trail
    Properties:
      EventSelectors:
        - ReadWriteType: All
      IsLogging: true
      S3BucketName:
        Ref: WatcherTrailBucket
      IsLogging: true
      S3KeyPrefix: logs/

Answer 1

您的 WatcherTrail 在 WatcherTrailBucketPolicy 之前运行，这就是它失败的原因(CloudFormation 不会按照模板中定义的顺序部署资源) )。添加对存储桶策略的显式 DependsOn 依赖项。此外，您的 WatcherTrailBucketPolicy 是不正确，并且试用需要一个名称。所以应该是:

  WatcherTrailBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket:
         Ref: WatcherTrailBucket
      PolicyDocument: !Sub |
        {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Sid": "AWSCloudTrailAclCheck20150319",
                    "Effect": "Allow",
                    "Principal": {"Service": "cloudtrail.amazonaws.com"},
                    "Action": "s3:GetBucketAcl",
                    "Resource": "arn:aws:s3:::${WatcherTrailBucket}",
                    "Condition": {
                        "StringEquals": {
                            "aws:SourceArn": "arn:aws:cloudtrail:${AWS::Region}:${AWS::AccountId}:trail/MyTrial"
                        }
                    }
                },
                {
                    "Sid": "AWSCloudTrailWrite20150319",
                    "Effect": "Allow",
                    "Principal": {"Service": "cloudtrail.amazonaws.com"},
                    "Action": "s3:PutObject",
                    "Resource": "arn:aws:s3:::${WatcherTrailBucket}/logs/AWSLogs/${AWS::AccountId}/*",
                    "Condition": {
                        "StringEquals": {
                            "s3:x-amz-acl": "bucket-owner-full-control",
                            "aws:SourceArn": "arn:aws:cloudtrail:${AWS::Region}:${AWS::AccountId}:trail/MyTrial"
                        }
                    }
                }
            ]
        }



  WatcherTrail:
    Type: AWS::CloudTrail::Trail
    DependsOn: WatcherTrailBucketPolicy
    Properties:
      TrailName: MyTrial
      EventSelectors:
        - ReadWriteType: All
      IsLogging: true
      S3BucketName:
        Ref: WatcherTrailBucket
      IsLogging: true
      S3KeyPrefix: logs/