https://docs.aws.amazon.com/ja_jp/eventbridge/latest/userguide/eb-log-s3-data-events.html
Amazon S3 バケットにオブジェクトレベルの API 操作のログを記録することができます。
Amazon EventBridge がこれらのイベントと一致するには、AWS CloudTrail を使用してこれらのイベントを受信する証跡を設定する必要があります。
-- 1. コマンド等のインストール
-- 1.1 aws cli version 2 インストール
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install
aws --version
-- 1.2 jqインストール
sudo yum -y install jq
-- 2. S3 バケットを作成する
bucket123-1 -->証跡用
bucket123-2 -->動作確認用
aws s3 mb s3://bucket123-1
aws s3 mb s3://bucket123-2
aws s3 ls
-- 3. バケットポリシーの追加
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AWSCloudTrailAclCheck20150319",
"Effect": "Allow",
"Principal": {"Service": "cloudtrail.amazonaws.com"},
"Action": "s3:GetBucketAcl",
"Resource": "arn:aws:s3:::bucket123-1"
},
{
"Sid": "AWSCloudTrailWrite20150319",
"Effect": "Allow",
"Principal": {"Service": "cloudtrail.amazonaws.com"},
"Action": "s3:PutObject",
"Resource": "arn:aws:s3:::bucket123-1/AWSLogs/999999999999/*",
"Condition": {
"StringEquals": {
"s3:x-amz-acl": "bucket-owner-full-control",
"aws:SourceArn": "arn:aws:cloudtrail:ap-northeast-1:999999999999:trail/trail01"
}
}
}
]
}
aws s3api put-bucket-policy \
--bucket bucket123-1 \
--policy file://policy01.json
aws s3api get-bucket-policy \
--bucket bucket123-1
-- 4. 証跡の作成
aws cloudtrail create-trail \
--name trail01 \
--s3-bucket-name bucket123-1 \
--no-include-global-service-events \
--no-is-multi-region-trail \
--no-enable-log-file-validation \
--no-is-organization-trail
aws cloudtrail list-trails
aws cloudtrail describe-trails
aws cloudtrail get-trail \
--name trail01
aws cloudtrail put-event-selectors \
--trail-name trail01 \
--event-selectors '[{
"ReadWriteType": "WriteOnly",
"IncludeManagementEvents": false,
"DataResources": [
{
"Type": "AWS::S3::Object",
"Values": [
"arn:aws:s3:::bucket123-2/test/"
]
}
],
"ExcludeManagementEventSources": []
}]'
aws cloudtrail get-event-selectors \
--trail-name trail01
-- 5. ログ記録の開始
aws cloudtrail get-trail-status \
--name trail01
aws cloudtrail start-logging \
--name trail01
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
aws iam create-role \
--role-name role01 \
--assume-role-policy-document file://role01.json
-- 7. ポリシーをロールにアタッチ
aws iam attach-role-policy \
--policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole \
--role-name role01
-- 8. Lambda関数作成
vim test.js
'use strict';
exports.handler = (event, context, callback) => {
console.log('LogS3DataEvents');
console.log('Received event:', JSON.stringify(event, null, 2));
callback(null, 'Finished');
};
chmod 755 test.js
zip test.zip test.js
aws lambda create-function \
--function-name func01 \
--zip-file fileb://test.zip \
--handler test.handler \
--runtime nodejs14.x \
--role arn:aws:iam::999999999999:role/role01
aws lambda list-functions | grep func01
aws lambda get-function --function-name func01
-- 9. ルールの作成
aws events put-rule \
--name rule01 \
--event-pattern '{
"source": ["aws.s3"],
"detail-type": ["AWS API Call via CloudTrail"],
"detail": {
"eventSource": ["s3.amazonaws.com"],
"eventName": ["PutObject"],
"requestParameters": {
"bucketName": ["bucket123-2"]
}
}
}' \
--state ENABLED \
--description rule01
aws events list-rules
aws events describe-rule --name rule01
-- 10. ターゲットの作成
aws events put-targets \
--rule rule01 \
--targets "Id"="1","Arn"="arn:aws:lambda:ap-northeast-1:999999999999:function:func01"
aws events list-targets-by-rule \
--rule rule01
-- 11. Lambda関数に権限を追加する
aws lambda add-permission \
--function-name func01 \
--statement-id events \
--action lambda:InvokeFunction \
--principal events.amazonaws.com \
--source-arn arn:aws:events:ap-northeast-1:999999999999:rule/rule01
aws lambda get-policy \
--function-name func01 | jq -r .Policy | jq .
-- 12. 動作確認
オブジェクトを S3 バケットに配置してキーがtest/の場合だけ
CloudWatch ログに Lambda イベントがあること確認
echo file01 > file01.txt
echo file02 > file02.txt
aws s3api put-object --bucket bucket123-2 --key test/file01.txt --body file01.txt
aws s3api put-object --bucket bucket123-2 --key hoge/file02.txt --body file02.txt
aws s3 ls s3://bucket123-2 --recursive
-- 13. クリーンアップ
-- ターゲットの削除
aws events list-targets-by-rule \
--rule rule01
aws events remove-targets \
--rule rule01 \
--ids 1
-- ルールの削除
aws events list-rules
aws events delete-rule \
--name rule01
-- Lambda関数の削除
aws lambda get-function --function-name func01
aws lambda delete-function --function-name func01
-- ロールの削除
aws iam list-roles | grep role01
aws iam detach-role-policy \
--role-name role01 \
--policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
aws iam delete-role --role-name role01
-- 証跡の削除
aws cloudtrail describe-trails
aws cloudtrail delete-trail \
--name trail01
-- バケットの削除
aws s3 ls
aws s3 rb s3://bucket123-1 --force
aws s3 rb s3://bucket123-2 --force
