amazon-cloudformation - 使用 cloudformation 模板的 cloudtrail 日志
问题描述
在 cloud-trail 中,我可以选择 CloudWatch Logs 部分下的现有日志组 CloudTrail/DefaultLogGroup。是否可以使用 cloudformation 模板完成此步骤?
解决方案
假设您也在使用 CloudFormation 创建日志组:
LogGroup: # A new log group
Type: AWS::Logs::LogGroup
Properties:
RetentionInDays: 365 # optional
CloudTrailLogsRole: # A role for your trail
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Action: sts:AssumeRole
Effect: Allow
Principal:
Service: cloudtrail.amazonaws.com
Version: '2012-10-17'
CloudTrailLogsPolicy: # The policy for your role
Type: AWS::IAM::Policy
Properties:
PolicyDocument:
Statement:
- Action:
- logs:PutLogEvents
- logs:CreateLogStream
Effect: Allow
Resource:
Fn::GetAtt:
- LogGroup
- Arn
Version: '2012-10-17'
PolicyName: DefaultPolicy
Roles:
- Ref: CloudTrailLogsRole
CloudTrail: # The trail
Type: AWS::CloudTrail::Trail
Properties:
IsLogging: true
CloudWatchLogsLogGroupArn:
Fn::GetAtt:
- LogGroup
- Arn
CloudWatchLogsRoleArn:
Fn::GetAtt:
- CloudTrailLogsRole
- Arn
DependsOn:
- CloudTrailLogsPolicy
- CloudTrailLogsRole
如果使用现有的日志组:
CloudTrailLogsRole: # A role for your trail
Type: AWS::IAM::Role
Properties:
AssumeRolePolicyDocument:
Statement:
- Action: sts:AssumeRole
Effect: Allow
Principal:
Service: cloudtrail.amazonaws.com
Version: '2012-10-17'
CloudTrailLogsPolicy: # The policy for your role
Type: AWS::IAM::Policy
Properties:
PolicyDocument:
Statement:
- Action:
- logs:PutLogEvents
- logs:CreateLogStream
Effect: Allow
Resource: <your existing log group arn here>
Version: '2012-10-17'
PolicyName: DefaultPolicy
Roles:
- Ref: CloudTrailLogsRole
CloudTrail: # The trail
Type: AWS::CloudTrail::Trail
Properties:
IsLogging: true
CloudWatchLogsLogGroupArn: <your existing log group arn here>
CloudWatchLogsRoleArn:
Fn::GetAtt:
- CloudTrailLogsRole
- Arn
DependsOn:
- CloudTrailLogsPolicy
- CloudTrailLogsRole
推荐阅读
- java - is using a hashmap with keys that are their values a bad idea?
- python - 用公式替换 numpy 数组中的每个像素
- css - 如何将 Bootstrap 4 中的列与不确定的列数对齐
- java - 自动装箱和取消装箱有什么区别以及何时使用它?
- python - 试图用圣杯转发请求
- javascript - json-ld 用于 Javascript 弹出窗口内容
- java - 尝试使用 JSF Primefaces 显示图像
- laravel - 保存文件大小后 Laravel 干预/图像没有更新
- c# - .net core 2.0 web api httppost 带有 xml 输入作为 null
- r - 在R中将街道号码与街道名称分开