logging - 在 AWS CloudTrail 中获取用户登录和注销信息

Question

我已使用 AWS 管理控制台启用 CloudTrail，Amazon S3 存储桶策略是启用 CloudTrail 时自动创建的默认策略。

我可以找到有关我登录的日志以及所有其他偶数日志 但是没有关于注销的信息 .有什么我需要为它做的还是它根本不存在？注销不归类为事件吗？

编辑 1

我是 CloudTrail 的新手，并试图了解什么是可能的，什么是不可能的。我有一个 IAM 用户，它只能对一个存储桶进行读写访问并列出所有存储桶。使用时我调用了 aws ec2 describe-instances我可以在日志中看到 errorCode: "Client.UnauthorizedOperation" ，但是当我做 aws s3 cp或 aws s3 ls它是成功的，它没有被记录。这是创建的默认存储桶策略。

{
"Version": "2012-10-17",
"Statement": [
    {
        "Sid": "AWSCloudTrailAclCheck20131101",
        "Effect": "Allow",
        "Principal": {
            "AWS": [
                "arn:aws:iam::903692715234:root",
                "arn:aws:iam::859597730677:root",
                "arn:aws:iam::814480443879:root",
                "arn:aws:iam::216624486486:root",
                "arn:aws:iam::086441151436:root",
                "arn:aws:iam::388731089494:root",
                "arn:aws:iam::284668455005:root",
                "arn:aws:iam::113285607260:root"
            ]
        },
        "Action": "s3:GetBucketAcl",
        "Resource": "arn:aws:s3:::MY_BUCKET"
    },
    {
        "Sid": "AWSCloudTrailWrite20131101",
        "Effect": "Allow",
        "Principal": {
            "AWS": [
                "arn:aws:iam::903692715234:root",
                "arn:aws:iam::859597730677:root",
                "arn:aws:iam::814480443879:root",
                "arn:aws:iam::216624486486:root",
                "arn:aws:iam::086441151436:root",
                "arn:aws:iam::388731089494:root",
                "arn:aws:iam::284668455005:root",
                "arn:aws:iam::113285607260:root"
            ]
        },
        "Action": "s3:PutObject",
        "Resource": "arn:aws:s3:::MY_BUCKET/MY_PREFIX/AWSLogs/MY_ACCOUNT_ID/*",
        "Condition": {
            "StringEquals": {
                "s3:x-amz-acl": "bucket-owner-full-control"
            }
        }
    }
]
}

以及在哪里以及为什么这样做可能 Principal来自 - 它们不是我的帐户，它们是在我启用 CloudTrail 时由 AWS 创建的。这些 AWS 账户是否将日志传送到我的存储桶，它们应该在那里吗？

编辑 2

来自 typepad's post ，S3 的日志记录还没有出现。我看到的登录实际上是因为 AWS 安全 token 服务 (STS) GetSessionToken称呼。如果从控制台注销，似乎没有调用 STS，因此没有结果日志。

Answer 1

一如既往，AWS 一直在倾听客户对更深入了解用户何时登录 AWS 管理控制台的需求，并刚刚宣布 AWS CloudTrail Now Logs AWS Management Console Sign-In Events ，从而通过 GetSessionToken 废弃间接方法并用显式和更详细的事件替换它:

Logging successful and unsuccessful console sign-in events for AWS IAM and federated users can help you with your compliance and security efforts. With this new feature, you get the following for both IAM and federated users:

• Every successful sign-in.
• Every unsuccessful sign-in attempt.
• Verification of when multi-factor authentication (MFA) was enforced.
• The IP address of every sign-in event.

Additionally, you can see a record of every time a root account successfully signs in. Finally, you can see when an IAM user has not signed in for a period of time, suggesting that you might be able to remove that IAM user.

不幸的是，注销事件仍然没有可见性。