如何使用 AWS CloudFormation 监控 IAM 事件并设置事件通知？
6 分钟阅读
0
我想使用 AWS CloudFormation 监控 AWS Identity and Access Management (IAM) 活动。例如，我想在有特定 IAM 事件发生时接收电子邮件通知。
简短描述
您可以使用以下解决方法中的 AWS CloudFormation 模板来监控 IAM 事件并使用 Amazon EventBridge 设置通知。
请考虑以下事项：
- 您必须在美国东部（弗吉尼亚北部）-us-east-1 AWS 区域部署模板。
- 您可以修改 AWS::SNS::Topic 资源以包含其他电子邮件地址。
- 您可以编辑 AWS::Events::Rule 资源以添加或删除其他 API 调用。
解决方法
以下模板包括包含 EventPattern 属性的 AWS::Events::Rule。您可以使用 EventPattern 属性为不同的事件源和 API 调用提供为您的应用场景添加或限制特定事件的能力。每个 API 调用在事件中都有不同的参数和信息。不可能创建一刀切事件规则。以下示例模板仅提供将许多不同 API 调用组合在一起的两个规则。但是，您可以根据需要使用尽可能多的规则来为不同的 API 调用创建电子邮件或通知。您可以自定义和定义要监控的 API 调用，并为每个调用定义自定义的电子邮件和信息。
1. 复制以下 JSON 或 YAML 版本的模板，然后使用您的环境的值对其进行更新。
JSON：
{ "AWSTemplateFormatVersion": "2010-09-09", "Description": "Monitor IAM events with EventBridge rules with AWS CloudFormation. This Stack must be deployed in 'us-east-1' (IAM).", "Parameters": { "EmailList": { "Type": "String", "Description": "Email to notify!", "AllowedPattern": "[a-zA-Z0-9]+@[a-zA-Z0-9]+\\.[a-zA-Z]+", "Default": "mail@example.com" }, "SNSTopicName": { "Type": "String", "Description": "Name for the notification topic.", "AllowedPattern": "[a-zA-Z0-9_-]+", "Default": "iam-monitoring-topic" }, "MonitorStatus": { "Type": "String", "Description": "Enable / Disable monitor.", "AllowedValues": [ "ENABLED", "DISABLED" ], "Default": "ENABLED" } }, "Resources": { "SNSMonitoringTopic": { "Type": "AWS::SNS::Topic", "Properties": { "Subscription": [ { "Endpoint": { "Ref": "EmailList" }, "Protocol": "email" } ], "TopicName": { "Fn::Sub": "${AWS::StackName}-${SNSTopicName}" } } }, "SNSMonitoringTopicTopicPolicy": { "Type": "AWS::SNS::TopicPolicy", "Properties": { "Topics": [ { "Ref": "SNSMonitoringTopic" } ], "PolicyDocument": { "Version": "2012-10-17", "Statement": [ { "Sid": "SnsIAMTopicPolicy", "Effect": "Allow", "Principal": { "Service": "events.amazonaws.com" }, "Action": [ "sns:Publish" ], "Resource": { "Ref": "SNSMonitoringTopic" } }, { "Sid": "AllowAccessToTopicOwner", "Effect": "Allow", "Principal": { "AWS": "*" }, "Action": [ "sns:GetTopicAttributes", "sns:SetTopicAttributes", "sns:AddPermission", "sns:RemovePermission", "sns:DeleteTopic", "sns:Subscribe", "sns:ListSubscriptionsByTopic", "sns:Publish", "sns:Receive" ], "Resource": { "Ref": "SNSMonitoringTopic" }, "Condition": { "StringEquals": { "AWS:SourceOwner": { "Ref": "AWS::AccountId" } } } } ] } } }, "EventRulePolicyMonitor": { "Type": "AWS::Events::Rule", "Properties": { "Name": { "Fn::Sub": "${AWS::StackName}-policy-monitor" }, "Description": "This EventBridge rule will capture IAM API Calls and events related to creation and deletion of policies.\n", "State": { "Ref": "MonitorStatus" }, "EventPattern": { "source": [ "aws.iam" ], "detail-type": [ "AWS API Call via CloudTrail" ], "detail": { "eventSource": [ "iam.amazonaws.com" ], "eventName": [ "CreatePolicy", "DeletePolicy", "PutGroupPolicy", "DeleteGroupPolicy", "PutRolePolicy", "DeleteRolePolicy", "PutUserPolicy", "DeleteUserPolicy", "CreatePolicyVersion", "DeletePolicyVersion", "AttachRolePolicy", "DetachRolePolicy", "AttachUserPolicy", "DetachUserPolicy", "AttachGroupPolicy", "DetachGroupPolicy" ] } }, "Targets": [ { "Arn": { "Ref": "SNSMonitoringTopic" }, "Id": "iam-policy-monitor", "InputTransformer": { "InputPathsMap": { "eventName": "$.detail.eventName", "policyName": "$.detail.requestParameters.policyName", "policyArn": "$.detail.requestParameters.policyArn", "eventTime": "$.detail.eventTime", "userIdentity": "$.detail.userIdentity.arn", "sourceIPAddress": "$.detail.sourceIPAddress" }, "InputTemplate": "\"API Call '<eventName>' was issued on policy '<policyName><policyArn>'. This occurred at '<eventTime>' and was initiated by '<userIdentity>' from IP '<sourceIPAddress>'. Please review the details here: https://console.aws.amazon.com/iam/home?region=us-east-1#/policies/<policyArn>$jsonEditor?section=attached_entities .\"\n" } } ] } }, "EventRulePrincipalsMonitor": { "Type": "AWS::Events::Rule", "Properties": { "Name": { "Fn::Sub": "${AWS::StackName}-principals-monitor" }, "Description": "This EventBridge rule will capture IAM API Calls and events related to creation and deletion of users, groups and roles.", "State": { "Ref": "MonitorStatus" }, "EventPattern": { "source": [ "aws.iam" ], "detail-type": [ "AWS API Call via CloudTrail" ], "detail": { "eventSource": [ "iam.amazonaws.com" ], "eventName": [ "CreateUser", "CreateGroup", "CreateRole", "UpdateUser", "UpdateGroup", "UpdateRole", "DeleteUser", "DeleteGroup", "DeleteRole" ] } }, "Targets": [ { "Arn": { "Ref": "SNSMonitoringTopic" }, "Id": "iam-user-monitor", "InputTransformer": { "InputPathsMap": { "eventName": "$.detail.eventName", "userName": "$.detail.requestParameters.userName", "roleName": "$.detail.requestParameters.roleName", "groupName": "$.detail.requestParameters.groupName", "eventTime": "$.detail.eventTime", "userIdentity": "$.detail.userIdentity.arn", "sourceIPAddress": "$.detail.sourceIPAddress" }, "InputTemplate": "\"API Call '<eventName>' was issued on '<userName><roleName><groupName>'. This occurred at '<eventTime>' and was initiated by '<userIdentity>' from IP '<sourceIPAddress>'. \"\n" } } ] } } } }
YAML：
AWSTemplateFormatVersion: 2010-09-09 Description: > - Monitor IAM events with EventBridge rules with AWS CloudFormation. - This Stack must be deployed in 'us-east-1' (IAM). Parameters: EmailList: Type: String Description: "Email to notify!" AllowedPattern: '[a-zA-Z0-9]+@[a-zA-Z0-9]+\.[a-zA-Z]+' Default: "mail@example.com" SNSTopicName: Type: String Description: "Name for the notification topic." AllowedPattern: '[a-zA-Z0-9_-]+' Default: "iam-monitoring-topic" MonitorStatus: Type: String Description: "Enable / Disable monitor." AllowedValues: - ENABLED - DISABLED Default: ENABLED Resources: SNSMonitoringTopic: Type: AWS::SNS::Topic Properties: Subscription: - Endpoint: !Ref EmailList Protocol: email TopicName: !Sub ${AWS::StackName}-${SNSTopicName} SNSMonitoringTopicTopicPolicy: Type: AWS::SNS::TopicPolicy Properties: Topics: - !Ref SNSMonitoringTopic PolicyDocument: Version: '2012-10-17' Statement: - Sid: SnsIAMTopicPolicy Effect: Allow Principal: Service: events.amazonaws.com Action: [ 'sns:Publish' ] Resource: !Ref SNSMonitoringTopic - Sid: AllowAccessToTopicOwner Effect: Allow Principal: AWS: '*' Action: [ 'sns:GetTopicAttributes', 'sns:SetTopicAttributes', 'sns:AddPermission', 'sns:RemovePermission', 'sns:DeleteTopic', 'sns:Subscribe', 'sns:ListSubscriptionsByTopic', 'sns:Publish', 'sns:Receive' ] Resource: !Ref SNSMonitoringTopic Condition: StringEquals: 'AWS:SourceOwner': !Ref 'AWS::AccountId' EventRulePolicyMonitor: Type: AWS::Events::Rule Properties: Name: !Sub ${AWS::StackName}-policy-monitor Description: > This EventBridge rule will capture IAM API Calls and events related to creation and deletion of policies. State: !Ref MonitorStatus EventPattern: source: - aws.iam detail-type: - AWS API Call via CloudTrail detail: eventSource: - iam.amazonaws.com eventName: - CreatePolicy - DeletePolicy - PutGroupPolicy - DeleteGroupPolicy - PutRolePolicy - DeleteRolePolicy - PutUserPolicy - DeleteUserPolicy - CreatePolicyVersion - DeletePolicyVersion - AttachRolePolicy - DetachRolePolicy - AttachUserPolicy - DetachUserPolicy - AttachGroupPolicy - DetachGroupPolicy Targets: - Arn: Ref: SNSMonitoringTopic Id: iam-policy-monitor InputTransformer: InputPathsMap: eventName: $.detail.eventName policyName: $.detail.requestParameters.policyName policyArn: $.detail.requestParameters.policyArn eventTime: $.detail.eventTime userIdentity: $.detail.userIdentity.arn sourceIPAddress: $.detail.sourceIPAddress InputTemplate: > "API Call '<eventName>' was issued on policy '<policyName><policyArn>'. This occurred at '<eventTime>' and was initiated by '<userIdentity>' from IP '<sourceIPAddress>'. Please review the details here: https://console.aws.amazon.com/iam/home?region=us-east-1#/policies/<policyArn>$jsonEditor?section=attached_entities ." EventRulePrincipalsMonitor: Type: AWS::Events::Rule Properties: Name: !Sub ${AWS::StackName}-principals-monitor Description: > This EventBridge rule will capture IAM API Calls and events related to creation and deletion of users, groups and roles. State: !Ref MonitorStatus EventPattern: source: - aws.iam detail-type: - AWS API Call via CloudTrail detail: eventSource: - iam.amazonaws.com eventName: - CreateUser - CreateGroup - CreateRole - UpdateUser - UpdateGroup - UpdateRole - DeleteUser - DeleteGroup - DeleteRole Targets: - Arn: Ref: SNSMonitoringTopic Id: iam-user-monitor InputTransformer: InputPathsMap: eventName: $.detail.eventName userName: $.detail.requestParameters.userName roleName: $.detail.requestParameters.roleName groupName: $.detail.requestParameters.groupName eventTime: $.detail.eventTime userIdentity: $.detail.userIdentity.arn sourceIPAddress: $.detail.sourceIPAddress InputTemplate: > "API Call '<eventName>' was issued on '<userName><roleName><groupName>'. This occurred at '<eventTime>' and was initiated by '<userIdentity>' from IP '<sourceIPAddress>'. "
2. 使用 AWS CloudFormation 控制台或 AWS 命令行界面 (AWS CLI) 来部署您的模板：
AWS CloudFormation 控制台
1. 下载模板。
2. 打开 AWS CloudFormation 控制台。
3. 从导航栏的 AWS 区域选择器中选择 us-east-1。
4. 选择 Create stack（创建堆栈），然后选择 With new resources (standard)（使用新资源(标准)）。
5. 在指定模板部分，选择上传模板文件。
6. 选择 Choose file（选择文件），选择您在步骤 1 中下载的模板，然后选择 Next（下一步）。
7. 在 **Stack name（堆栈名称）**部分，对于 Stack name（堆栈名称），输入堆栈的名称。
8. 在 **Parameters（参数）**部分，对于 EmailList，输入要接收通知的电子邮件地址。
9. 对于 MonitorStatus，选择 ENABLED（已启用）。
10. 对于 SNSTopicName，请保留默认名称，或为 Amazon Simple Notification Service (Amazon SNS) 主题选择您自己的名称。
11. 完成安装向导中的其余步骤，然后选择 Create stack（创建堆栈）。
12. 检查收件箱（使用您在步骤 8 中输入的电子邮件地址）以获取确认电子邮件，然后按照电子邮件中的说明来确认您的订阅。
AWS CLI
**注意：**如果在运行 AWS CLI 命令时收到错误，请确保您使用的是最新的 AWS CLI 版本。
1. 下载模板，然后将模板命名为 sample-event-rule-iam-sns.yaml。
2. 设置 AWS CLI。
3. 在操作系统中打开命令行，然后转到模板所在的文件夹。
4. 运行以下命令：
aws cloudformation --region=us-east-1 \ create-stack \ --stack-name iam-sample-monitor \ --template-body file://sample-event-rule-iam-sns.yaml \ --parameters \ ParameterKey=EmailList,ParameterValue="mail@example.com"
**注意：**将 mail@example.com 替换为您想要接收通知的电子邮件。
5. 检查收件箱（使用您在步骤 4 中输入的电子邮件地址）以获取确认电子邮件，然后按照电子邮件中的说明来确认您的订阅。
测试监控通知
1. 打开 IAM 控制台。
2. 创建测试策略。
3. 查收电子邮件，获取有关事件的通知。您会收到类似如下内容的电子邮件：
API Call 'CreatePolicy' was issued on policy 'test-policy'. This occurred at '2020-11-13T00:00:00Z' and was initiated by 'arn:aws:sts::123456789012:assumed-role/your-role' from IP 'X.Y.Z.T'. Please review the details here: https://console.aws.amazon.com/iam/home?region=us-east-1#/policies/$jsonEditor?section=attached_entities.
相关信息
AWS 官方已更新 3 年前
没有评论
相关内容
- AWS 官方已更新 9 个月前
- AWS 官方已更新 10 个月前
- AWS 官方已更新 3 年前
