https://docs.aws.amazon.com/ja_jp/eventbridge/latest/userguide/eb-log-api-call.html
EC2 -> Cloud Trail -> EventBridge -> Lambda
detail-type の値が AWS API Call via CloudTrail のイベントを記録するには、ロギングを有効にした CloudTrail 証跡が必要です。
-- 1. コマンド等のインストール
-- 1.1 aws cli version 2 インストール
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install
aws --version
-- 1.2 jqインストール
sudo yum -y install jq
-- 2. S3 バケットを作成する
aws s3 mb s3://bucket123
aws s3 ls
-- 3. バケットポリシーの追加
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AWSCloudTrailAclCheck20150319",
"Effect": "Allow",
"Principal": {"Service": "cloudtrail.amazonaws.com"},
"Action": "s3:GetBucketAcl",
"Resource": "arn:aws:s3:::bucket123"
},
{
"Sid": "AWSCloudTrailWrite20150319",
"Effect": "Allow",
"Principal": {"Service": "cloudtrail.amazonaws.com"},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::bucket123/AWSLogs/999999999999/*",
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "bucket-owner-full-control",
"aws:SourceArn": "arn:aws:cloudtrail:ap-northeast-1:999999999999:trail/trail01"
}
}
}
]
}
aws s3api put-bucket-policy \
--bucket bucket123 \
--policy file://policy01.json
aws s3api get-bucket-policy \
--bucket bucket123
-- 4. 証跡の作成
aws cloudtrail create-trail \
--name trail01 \
--s3-bucket-name bucket123 \
--include-global-service-events \
--is-multi-region-trail \
--enable-log-file-validation \
--no-is-organization-trail
aws cloudtrail list-trails
aws cloudtrail describe-trails
aws cloudtrail get-trail \
--name trail01
-- 5. ログ記録の開始
aws cloudtrail get-trail-status \
--name trail01
aws cloudtrail start-logging \
--name trail01
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
aws iam create-role \
--role-name role01 \
--assume-role-policy-document file://role01.json
-- 7. ポリシーをロールにアタッチ
aws iam attach-role-policy \
--policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole \
--role-name role01
-- 8. Lambda関数作成
vim test.js
'use strict';
exports.handler = (event, context, callback) => {
console.log('LogEC2StopInstance');
console.log('Received event:', JSON.stringify(event, null, 2));
callback(null, 'Finished');
};
chmod 755 test.js
zip test.zip test.js
aws lambda create-function \
--function-name func01 \
--zip-file fileb://test.zip \
--handler test.handler \
--runtime nodejs14.x \
--role arn:aws:iam::999999999999:role/role01
aws lambda list-functions | grep func01
aws lambda get-function --function-name func01
-- 9. ルールの作成
aws events put-rule \
--name rule01 \
--event-pattern '{
"source": ["aws.ec2"],
"detail-type": ["AWS API Call via CloudTrail"],
"detail": {
"eventSource": ["ec2.amazonaws.com"],
"eventName": ["StopInstances"]
}
}' \
--state ENABLED \
--description rule01
aws events list-rules
aws events describe-rule --name rule01
-- 10. ターゲットの作成
aws events put-targets \
--rule rule01 \
--targets "Id"="1","Arn"="arn:aws:lambda:ap-northeast-1:999999999999:function:func01"
aws events list-targets-by-rule \
--rule rule01
-- 11. Lambda関数に権限を追加する
aws lambda add-permission \
--function-name func01 \
--statement-id events \
--action lambda:InvokeFunction \
--principal events.amazonaws.com \
--source-arn arn:aws:events:ap-northeast-1:999999999999:rule/rule01
aws lambda get-policy \
--function-name func01 | jq -r .Policy | jq .
-- 12. 動作確認
EC2インスタンスを停止し
CloudWatch ログに Lambda イベントがあること確認
EC2インスタンスを開始し
CloudWatch ログに Lambda イベントがないこと確認
aws s3 ls s3://bucket123 --recursive
-- 13. クリーンアップ
-- ターゲットの削除
aws events list-targets-by-rule \
--rule rule01
aws events remove-targets \
--rule rule01 \
--ids 1
-- ルールの削除
aws events list-rules
aws events delete-rule \
--name rule01
-- Lambda関数の削除
aws lambda get-function --function-name func01
aws lambda delete-function --function-name func01
-- ロールの削除
aws iam list-roles | grep role01
aws iam detach-role-policy \
--role-name role01 \
--policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
aws iam delete-role --role-name role01
-- 証跡の削除
aws cloudtrail describe-trails
aws cloudtrail delete-trail \
--name trail01
-- バケットの削除
aws s3 ls
aws s3 rb s3://bucket123 --force
