16.5 C
London
Wednesday, July 10, 2024

Monitor knowledge occasions in Amazon S3 Categorical One Zone with AWS CloudTrail


Voiced by Polly

In a Information Weblog submit for re:Invent 2023, we launched you to Amazon S3 Categorical One Zone, a high-performance, single-Availability Zone (AZ) storage class purpose-built to ship constant single-digit millisecond knowledge entry in your most continuously accessed knowledge and latency-sensitive purposes. It’s well-suited for demanding purposes and is designed to ship as much as 10x higher efficiency than S3 Normal. S3 Categorical One Zone makes use of S3 listing buckets to retailer objects in a single AZ.

Beginning at this time, S3 Categorical One Zone helps AWS CloudTrail knowledge occasion logging, permitting you to observe all object-level operations like PutObject, GetObject, and DeleteObject, along with bucket-level actions like CreateBucket and DeleteBucket that had been already supported. This permits auditing for governance and compliance, and will help you make the most of S3 Categorical One Zone’s 50% decrease requests prices in comparison with the S3 Normal storage class.

Utilizing this new functionality, you may shortly decide which S3 Categorical One Zone objects had been created, learn, up to date, or deleted, and determine the supply of the API calls. For those who detect unauthorized S3 Categorical One Zone object entry, you may take rapid motion to limit entry. Moreover, you should use the CloudTrail integration with Amazon EventBridge to create rule-based workflows which are triggered by knowledge occasions.

Utilizing CloudTrail knowledge occasion logging for Amazon S3 Categorical One Zone
I begin within the Amazon S3 console. Following the steps to create a listing bucket, I create an S3 bucket and select Listing because the bucket kind and apne1-az4 because the Availability Zone. In Base Identify, I enter s3express-one-zone-cloudtrail and a suffix that features Availability Zone ID of the Availability Zone is robotically added to create the ultimate title. Lastly, I choose the checkbox to acknowledge that Knowledge is saved in a single Availability Zone and select Create bucket.

To allow knowledge occasion logging for S3 Categorical One Zone, I am going to the CloudTrail console. I enter the title and create the CloudTrail path liable for monitoring the occasions of my S3 listing bucket.

In Step 2: Select log occasions, I choose Knowledge occasions with Superior occasion selectors are enabled chosen.

For Knowledge occasion kind, I select S3 Categorical. I can select Log all occasions because the Log selector template to handle knowledge occasions for all S3 listing buckets.

Nonetheless, I would like the occasion knowledge retailer to log occasions just for my S3 listing bucket s3express-one-zone-cloudtrail--apne1-az4--x-s3. On this case, I select Customized because the Log selector template and point out the ARN of my listing bucket. Study extra within the documentation on filtering knowledge occasions by utilizing superior occasion selectors.

End up with Step 3: assessment and create. Now, you will have logging with CloudTrail enabled.

CloudTrail knowledge occasion logging for S3 Categorical One Zone in motion:
Utilizing the S3 console, I add and obtain a file to my S3 listing bucket.

Utilizing AWS CLI, I ship Put_Object and Get_Object.

$ aws s3api put-object --bucket s3express-one-zone-cloudtrail--apne1-az4--x-s3 
  --key cloudtrail_test   
--body cloudtrail_test.txt

$ aws s3api get-object --bucket s3express-one-zone-cloudtrail--apne1-az4--x-s3  
--key cloudtrail_test response.txt

CloudTrail publishes log information to S3 bucket in a gzip archive and organizes them hierarchically primarily based on the bucket title, account ID, Area, and date. Utilizing the AWS CLI, I checklist the bucket related to my Path and retrieve the log information for the date once I did the check.

$ aws s3 ls s3://aws-cloudtrail-logs-MY-ACCOUNT-ID-3b49f368/AWSLogs/MY-ACCOUNT-ID/CloudTrail/ap-northeast-1/2024/07/01/

I get the next 4 information title, two from the console assessments and two from the CLI assessments:

2024-07-05 20:44:16 317 MY-ACCOUNT-ID_CloudTrail_ap-northeast-1_20240705T2044Z_lzCPfDRSf9OdkdC1.json.gz
2024-07-05 20:47:36 387 MY-ACCOUNT-ID_CloudTrail_ap-northeast-1_20240705T2047Z_95RwiqAHCIrM9rcl.json.gz
2024-07-05 21:37:48 373 MY-ACCOUNT-ID_CloudTrail_ap-northeast-1_20240705T2137Z_Xk17zhf0cTY0N5bH.json.gz
2024-07-05 21:42:44 314 MY-ACCOUNT-ID_CloudTrail_ap-northeast-1_20240705T21415Z_dhyTsSb3ZeAhU6hR.json.gz

Let’s seek for the PutObject occasion amongst these information. Once I open the primary file, I can see the PutObject occasion kind. For those who recall, I simply made two uploads, as soon as through the S3 console in a browser and as soon as utilizing the CLI. The userAgent attribute, the kind of supply that made the API name, refers to a browser, so this occasion refers to my add utilizing the S3 console. Study extra about CloudTrail occasions within the documentation on understanding CloudTrail occasions.

{...},
"eventTime": "2024-07-05T20:44:16Z",
"eventSource": "s3express.amazonaws.com",
"eventName": "PutObject",
"awsRegion": "ap-northeast-1",
"sourceIPAddress": "MY-IP",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36",
"requestParameters": {
...
},
"responseElements": {...},
"additionalEventData": {...},
...
"sources": [
{
"type": "AWS::S3Express::Object",
"ARN": "arn:aws:s3express:ap-northeast-1:MY-ACCOUNT-ID:bucket/s3express-one-zone-cloudtrail--apne1-az4--x-s3/cloudtrail_example.png"
},
{
"accountId": "MY-ACCOUNT-ID",
"type": "AWS::S3Express::DirectoryBucket",
"ARN": "arn:aws:s3express:ap-northeast-1:MY-ACCOUNT-ID:bucket/s3express-one-zone-cloudtrail--apne1-az4--x-s3"
}
],
{...}

Now, once I assessment the third file for the occasion comparable to the PutObject command despatched utilizing AWS CLI, I see that there’s a small distinction within the userAgent attribute. On this case, it refers back to the AWS CLI.

{...},
"eventTime": "2024-07-05T21:37:19Z",
"eventSource": "s3express.amazonaws.com",
"eventName": "PutObject",
"awsRegion": "ap-northeast-1",
"sourceIPAddress": "MY-IP",
"userAgent": "aws-cli/2.17.9 md/awscrt#0.20.11 ua/2.0 os/linux#5.10.218-208.862.amzn2.x86_64 md/arch#x86_64 lang/python#3.11.8 md/pyimpl#CPython cfg/retry-mode#commonplace md/installer#exe md/distrib#amzn.2 md/immediate#off md/command#s3api.put-object",
"requestParameters": {
...
},
"responseElements": {...},
"additionalEventData": {...},
...
"sources": [
{
"type": "AWS::S3Express::Object",
"ARN": "arn:aws:s3express:ap-northeast-1:MY-ACCOUNT-ID:bucket/s3express-one-zone-cloudtrail--apne1-az4--x-s3/cloudtrail_example.png"
},
{
"accountId": "MY-ACCOUNT-ID",
"type": "AWS::S3Express::DirectoryBucket",
"ARN": "arn:aws:s3express:ap-northeast-1:MY-ACCOUNT-ID:bucket/s3express-one-zone-cloudtrail--apne1-az4--x-s3"
}
],
{...}

Now, let’s take a look at the GetObject occasion within the second file. I can see that the occasion kind is GetObject and that the userAgent refers to a browser, so this occasion refers to my obtain utilizing the S3 console.

{...},
"eventTime": "2024-07-05T20:47:41Z",
"eventSource": "s3express.amazonaws.com",
"eventName": "GetObject",
"awsRegion": "ap-northeast-1",
"sourceIPAddress": "MY-IP",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36",
"requestParameters": {
...
},
"responseElements": {...},
"additionalEventData": {...},
...
"sources": [
{
"type": "AWS::S3Express::Object",
"ARN": "arn:aws:s3express:ap-northeast-1:MY-ACCOUNT-ID:bucket/s3express-one-zone-cloudtrail--apne1-az4--x-s3/cloudtrail_example.png"
},
{
"accountId": "MY-ACCOUNT-ID",
"type": "AWS::S3Express::DirectoryBucket",
"ARN": "arn:aws:s3express:ap-northeast-1:MY-ACCOUNT-ID:bucket/s3express-one-zone-cloudtrail--apne1-az4--x-s3"
}
],
{...}

And at last, let me present the occasion within the fourth file, with particulars of the GetObject command that I despatched from the AWS CLI. I can see that the eventName and userAgent are as anticipated.

{...},
"eventTime": "2024-07-05T21:42:04Z",
"eventSource": "s3express.amazonaws.com",
"eventName": "GetObject",
"awsRegion": "ap-northeast-1",
"sourceIPAddress": "MY-IP",
"userAgent": "aws-cli/2.17.9 md/awscrt#0.20.11 ua/2.0 os/linux#5.10.218-208.862.amzn2.x86_64 md/arch#x86_64 lang/python#3.11.8 md/pyimpl#CPython cfg/retry-mode#commonplace md/installer#exe md/distrib#amzn.2 md/immediate#off md/command#s3api.put-object",
"requestParameters": {
...
},
"responseElements": {...},
"additionalEventData": {...},
...
"sources": [
{
"type": "AWS::S3Express::Object",
"ARN": "arn:aws:s3express:ap-northeast-1:MY-ACCOUNT-ID:bucket/s3express-one-zone-cloudtrail--apne1-az4--x-s3/cloudtrail_example.png"
},
{
"accountId": "MY-ACCOUNT-ID",
"type": "AWS::S3Express::DirectoryBucket",
"ARN": "arn:aws:s3express:ap-northeast-1:MY-ACCOUNT-ID:bucket/s3express-one-zone-cloudtrail--apne1-az4--x-s3"
}
],
{...}

Issues to know

Getting began – You may allow CloudTrail knowledge occasion logging for S3 Categorical One Zone utilizing the CloudTrail console, CLI, or SDKs.

Areas – CloudTrail knowledge occasion logging is out there in all AWS Areas the place S3 Categorical One Zone is presently accessible.

Exercise logging – With CloudTrail knowledge occasion logging for S3 Categorical One Zone, you may object-level exercise, resembling PutObjectGetObject , and DeleteObject, in addition to bucket-level exercise, resembling CreateBucket and DeleteBucket.

Pricing – As with S3 storage courses, you pay for logging S3 Categorical One Zone knowledge occasions in CloudTrail primarily based on the variety of occasions logged and the interval throughout which you keep the logs. For extra data, see the AWS CloudTrail Pricing web page.

You may allow CloudTrail knowledge occasion logging for S3 Categorical One Zone to simplify governance and compliance in your high-performance storage. To study extra about this new functionality, go to the S3 Person Information.

Eli.

Latest news
Related news

LEAVE A REPLY

Please enter your comment!
Please enter your name here