python-3.x - 我在哪里可以获得 AWS 用户所做的事件日志

Question

我对 AWS 相当陌生，对 IAM 完全陌生。我已经设置了一些用户帐户和组。

我还没有看到用户操作的日志。如果从控制台创建、重启、停止或删除了 EC2 实例，我想知道哪个用户发出了该命令。

Answer 1

您可能正在寻找 AWS CloudTrail:

AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. With CloudTrail, you can log, continuously monitor, and retain account activity related to actions across your AWS infrastructure. CloudTrail provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. This event history simplifies security analysis, resource change tracking, and troubleshooting.

AWS CloudTrail increases visibility into your user and resource activity by recording AWS Management Console actions and API calls. You can identify which users and accounts called AWS, the source IP address from which the calls were made, and when the calls occurred.

https://aws.amazon.com/cloudtrail/