上次更新时间：2020 年 11 月 18 日
我想使用 AWS CloudFormation 监控 AWS Identity and Access Management (IAM) 活动。例如，我想在有特定 IAM 事件发生时接收电子邮件通知。
简短描述您可以使用以下解决方法中的 AWS CloudFormation 模板来监控 IAM 事件并使用 Amazon CloudWatch Events 设置通知。
请考虑以下事项：
您必须在美国东部（弗吉尼亚北部）-us-east-1 AWS 区域部署模板。 您可以修改 AWS::SNS::Topic资源以包含其他电子邮件地址。 您可以编辑AWS::Events::Rule 资源以添加或删除其他 API 调用。 解决方法以下模板包括包含EventPattern 属性的AWS::Events::Rule。您可以使用 EventPattern 属性为不同的事件源和 API 调用提供为您的应用场景添加或限制特定事件的能力。每个 API 调用在事件中都有不同的参数和信息。不可能创建一刀切事件规则。以下示例模板仅提供将许多不同 API 调用组合在一起的两个规则。但是，您可以根据需要使用尽可能多的规则来为不同的 API 调用创建电子邮件或通知。您可以自定义和定义要监控的 API 调用，并为每个调用定义自定义的电子邮件和信息。
1. 复制以下 JSON 或 YAML 版本的模板，然后使用您的环境的值对其进行更新。
JSON：
{
"AWSTemplateFormatVersion": "2010-09-09",
"Description": "Monitor IAM events with CloudWatch Events rules with AWS CloudFormation. This Stack must be deployed in 'us-east-1' (IAM).",
"Parameters": {
"EmailList": {
"Type": "String",
"Description": "Email to notify!",
"AllowedPattern": "+@+\\.+",
"Default": "mail@company.com"
},
"SNSTopicName": {
"Type": "String",
"Description": "Name for the notification topic.",
"AllowedPattern": "+",
"Default": "iam-monitoring-topic"
},
"MonitorStatus": {
"Type": "String",
"Description": "Enable / Disable monitor.",
"AllowedValues": ,
"Default": "ENABLED"
}
},
"Resources": {
"SNSMonitoringTopic": {
"Type": "AWS::SNS::Topic",
"Properties": {
"Subscription": ,
"TopicName": {
"Fn::Sub": "${AWS::StackName}-${SNSTopicName}"
}
}
},
"SNSMonitoringTopicTopicPolicy": {
"Type": "AWS::SNS::TopicPolicy",
"Properties": {
"Topics": ,
"PolicyDocument": {
"Version": "2012-10-17",
"Statement": ,
"Resource": {
"Ref": "SNSMonitoringTopic"
}
},
{
"Sid": "AllowAccessToTopicOwner",
"Effect": "Allow",
"Principal": {
"AWS": "*"
},
"Action": ,
"Resource": {
"Ref": "SNSMonitoringTopic"
},
"Condition": {
"StringEquals": {
"AWS:SourceOwner": {
"Ref": "AWS::AccountId"
}
}
}
}
]
}
}
},
"EventRulePolicyMonitor": {
"Type": "AWS::Events::Rule",
"Properties": {
"Name": {
"Fn::Sub": "${AWS::StackName}-policy-monitor"
},
"Description": "This CloudWatch Event Rule will capture IAM API Calls and events related to creation and deletion of policies.\n",
"State": {
"Ref": "MonitorStatus"
},
"EventPattern": {
"source": ,
"detail-type": ,
"detail": {
"eventSource": ,
"eventName":
}
},
"Targets":
}
},
"EventRulePrincipalsMonitor": {
"Type": "AWS::Events::Rule",
"Properties": {
"Name": {
"Fn::Sub": "${AWS::StackName}-principals-monitor"
},
"Description": "This CloudWatch Event Rule will capture IAM API Calls and events related to creation and deletion of users, groups and roles.",
"State": {
"Ref": "MonitorStatus"
},
"EventPattern": {
"source": ,
"detail-type": ,
"detail": {
"eventSource": ,
"eventName":
}
},
"Targets":
}
}
}
}
YAML：
AWSTemplateFormatVersion: 2010-09-09
Description: >
- Monitor IAM events with CloudWatch Events rules with AWS CloudFormation.
- This Stack must be deployed in 'us-east-1' (IAM).
Parameters:
EmailList:
Type: String
Description: "Email to notify!"
AllowedPattern: '+@+\.+'
Default: "mail@company.com"
SNSTopicName:
Type: String
Description: "Name for the notification topic."
AllowedPattern: '+'
Default: "iam-monitoring-topic"
MonitorStatus:
Type: String
Description: "Enable / Disable monitor."
AllowedValues:
- ENABLED
- DISABLED
Default: ENABLED
Resources:
SNSMonitoringTopic:
Type: AWS::SNS::Topic
Properties:
Subscription:
- Endpoint: !Ref EmailList
Protocol: email
TopicName: !Sub ${AWS::StackName}-${SNSTopicName}
SNSMonitoringTopicTopicPolicy:
Type: AWS::SNS::TopicPolicy
Properties:
Topics:
- !Ref SNSMonitoringTopic
PolicyDocument:
Version: '2012-10-17'
Statement:
- Sid: SnsIAMTopicPolicy
Effect: Allow
Principal:
Service: events.amazonaws.com
Action:
Resource: !Ref SNSMonitoringTopic
- Sid: AllowAccessToTopicOwner
Effect: Allow
Principal:
AWS: '*'
Action:
Resource: !Ref SNSMonitoringTopic
Condition:
StringEquals:
'AWS:SourceOwner': !Ref 'AWS::AccountId'
EventRulePolicyMonitor:
Type: AWS::Events::Rule
Properties:
Name: !Sub ${AWS::StackName}-policy-monitor
Description: >
This CloudWatch Event Rule will capture IAM API Calls and
events related to creation and deletion of policies.
State: !Ref MonitorStatus
EventPattern:
source:
- aws.iam
detail-type:
- AWS API Call via CloudTrail
detail:
eventSource:
- iam.amazonaws.com
eventName:
- CreatePolicy
- DeletePolicy
- PutGroupPolicy
- DeleteGroupPolicy
- PutRolePolicy
- DeleteRolePolicy
- PutUserPolicy
- DeleteUserPolicy
- CreatePolicyVersion
- DeletePolicyVersion
- AttachRolePolicy
- DetachRolePolicy
- AttachUserPolicy
- DetachUserPolicy
- AttachGroupPolicy
- DetachGroupPolicy
Targets:
- Arn:
Ref: SNSMonitoringTopic
Id: iam-policy-monitor
InputTransformer:
InputPathsMap:
eventName: $.detail.eventName
policyName: $.detail.requestParameters.policyName
policyArn: $.detail.requestParameters.policyArn
eventTime: $.detail.eventTime
userIdentity: $.detail.userIdentity.arn
sourceIPAddress: $.detail.sourceIPAddress
InputTemplate: >
"API Call '<eventName>' was issued on policy '<policyName><policyArn>'. This occurred at '<eventTime>' and was initiated by '<userIdentity>' from IP '<sourceIPAddress>'. Please review the details here: https://console.aws.amazon.com/iam/home?region=us-east-1#/policies/<policyArn>$jsonEditor?section=attached_entities ."
EventRulePrincipalsMonitor:
Type: AWS::Events::Rule
Properties:
Name: !Sub ${AWS::StackName}-principals-monitor
Description: >
This CloudWatch Event Rule will capture IAM API Calls and
events related to creation and deletion of users, groups
and roles.
State: !Ref MonitorStatus
EventPattern:
source:
- aws.iam
detail-type:
- AWS API Call via CloudTrail
detail:
eventSource:
- iam.amazonaws.com
eventName:
- CreateUser
- CreateGroup
- CreateRole
- UpdateUser
- UpdateGroup
- UpdateRole
- DeleteUser
- DeleteGroup
- DeleteRole
Targets:
- Arn:
Ref: SNSMonitoringTopic
Id: iam-user-monitor
InputTransformer:
InputPathsMap:
eventName: $.detail.eventName
userName: $.detail.requestParameters.userName
roleName: $.detail.requestParameters.roleName
groupName: $.detail.requestParameters.groupName
eventTime: $.detail.eventTime
userIdentity: $.detail.userIdentity.arn
sourceIPAddress: $.detail.sourceIPAddress
InputTemplate: >
"API Call '<eventName>' was issued on '<userName><roleName><groupName>'. This occurred at '<eventTime>' and was initiated by '<userIdentity>' from IP '<sourceIPAddress>'. "2. 使用 AWS CloudFormation 控制台或 AWS 命令行界面 (AWS CLI) 来部署您的模板：
AWS CloudFormation 控制台
1.下载模板。
2.打开 AWS CloudFormation 控制台。
3. 从导航栏的 AWS 区域选择器中选择 us-east-1。
4.选择 Create stack（创建堆栈），然后选择 With new resources (standard)（使用新资源(标准)）。
5. 在 Specify template（指定模板）部分，选择 Upload a template file（上传模板文件）。
6. 选择 Choose file（选择文件），选择您在步骤 1 中下载的模板，然后选择 Next（下一步）。
7. 在 Stack name（堆栈名称）部分，对于 Stack name（堆栈名称），输入堆栈的名称。
8. 在 Parameters（参数）部分，对于 EmailList，输入要接收通知的电子邮件地址。
9. 对于 MonitorStatus，选择 ENABLED（已启用）。
10. 对于 SNSTopicName，请保留默认名称，或为 Amazon Simple Notification Service (Amazon SNS) 主题选择您自己的名称。
11.完成安装向导中的其余步骤，然后选择 Create stack（创建堆栈）。
12. 检查收件箱（使用您在步骤 8 中输入的电子邮件地址）以获取确认电子邮件，然后按照电子邮件中的说明来确认您的订阅。
AWS CLI
注意：如果在运行 AWS CLI 命令时收到错误，请确保您使用的是最新的 AWS CLI 版本。
1.下载模板，然后将模板命名为 sample-event-rule-iam-sns.yaml。
2. 设置 AWS CLI。
3. 在操作系统中打开命令行，然后转到模板所在的文件夹。
4. 运行以下命令：
aws cloudformation --region=us-east-1 \
create-stack \
--stack-name iam-sample-monitor \
--template-body file://sample-event-rule-iam-sns.yaml \
--parameters \
ParameterKey=EmailList,ParameterValue="mail@company.com"注意：将 mail@company.com 替换为您想要接收通知的电子邮件。
5. 检查收件箱（使用您在步骤 4 中输入的电子邮件地址）以获取确认电子邮件，然后按照电子邮件中的说明来确认您的订阅。
测试监控通知1.打开 IAM 控制台。
2.创建测试策略。
3.查收电子邮件，获取有关事件的通知。您会收到类似如下内容的电子邮件：
API Call 'CreatePolicy' was issued on policy 'test-policy'.
This occurred at '2020-11-13T00:00:00Z' and was initiated by 'arn:aws:sts::123456789012:assumed-role/your-role' from IP 'X.Y.Z.T'.
Please review the details here: https://console.aws.amazon.com/iam/home?region=us-east-1#/policies/$jsonEditor?section=attached_entities.