时间戳

首页 > 解决方案 > Set Event Value for Cloudtrail - all S3 buckets

amazon-cloudformation - Set Event Value for Cloudtrail - all S3 buckets

问题描述

I'm trying to get a cloudtrail for all S3 bucket Data but it keeps throwing an error. The template looks like:

DataTrail:
 Type: AWS::CloudTrail::Trail
 Properties:
  CloudWatchLogsLogGroupArn: 
    Fn::ImportValue:
      !Sub ${EnvironmentName}-CloudtrailLogGroupARN
  CloudWatchLogsRoleArn: 
    Fn::ImportValue:
      !Sub ${EnvironmentName}-CloudTrailLogsRoleARN
  EnableLogFileValidation: true
  EventSelectors:
    - DataResources:
       - Type: AWS::S3::Object
         Values:
            - 'arn:aws:s3:::*'
    - IncludeManagementEvents: false
    - ReadWriteType: All
  IncludeGlobalServiceEvents: true
  IsLogging: true
  IsMultiRegionTrail: true
  KMSKeyId:
    Fn::ImportValue:
      !Sub ${EnvironmentName}-InvoicegenKey-CMK-Arn
  S3BucketName:
    Fn::ImportValue:
      !Sub ${EnvironmentName}-CloudTrailBucket-Name

the AWS Doku says it must be a list of string, so I did:

         Values:
        - 'arn:aws:s3:::*'

But it keeps failing...

Merci in Advance

A

标签： amazon-cloudformation

解决方案

最后，这很容易；我刚刚通过控制台创建了一条线索，然后用来aws cloudtrail get-event-selectors --trail-name <name>获取结果。然后像这样将它转移到我的模板中：

DataResources:
    - Type: AWS::S3::Object
      Values:
      - arn:aws:s3

推荐阅读