Registro de llamadas a la API de Amazon Managed Grafana mediante AWS CloudTrail - Amazon Managed Grafana
Eventos de administración de Amazon Managed Grafana en CloudTrailEjemplos de eventos de Amazon Managed GrafanaEjemplos de eventos de la API de Grafana

Las traducciones son generadas a través de traducción automática. En caso de conflicto entre la traducción y la version original de inglés, prevalecerá la version en inglés.

Registro de llamadas a la API de Amazon Managed Grafana mediante AWS CloudTrail

Amazon Managed Grafana se integra con AWS CloudTrail, un servicio que proporciona un registro de las acciones que lleva a cabo un usuario, un rol o un Servicio de AWS. CloudTrail captura todas las llamadas a la API para Amazon Managed Grafana como eventos. Las llamadas capturadas incluyen aquellas que se hicieron desde la consola de Amazon Managed Grafana y las llamadas de código a las operaciones de la API de Amazon Managed Grafana.

Amazon Managed Grafana también captura algunas llamadas que utilizan las API de Grafana. Las llamadas capturadas son las que modifican los datos, como las llamadas que crean, actualizan o eliminan recursos. Para obtener más información sobre las API de Grafana que son compatibles con Amazon Managed Grafana, consulte Uso de las API HTTP de Grafana.

Mediante la información que recopila CloudTrail, puede determinar la solicitud que se hizo a Amazon Managed Grafana, la dirección IP desde la que se hizo, cuándo se hizo y detalles adicionales.

Cada entrada de registro o evento contiene información sobre quién generó la solicitud. La información de identidad del usuario le ayuda a determinar lo siguiente:

  • Si la solicitud se realizó con las credenciales del usuario raíz o del usuario.

  • Si la solicitud se realizó en nombre de un usuario de IAM Identity Center.

  • Si la solicitud se realizó con credenciales de seguridad temporales de un rol o fue un usuario federado.

  • Si la solicitud la realizó otro Servicio de AWS.

CloudTrail está activado en la Cuenta de AWS cuando usted crea la cuenta y tiene acceso automático al Historial de eventos de CloudTrail. El Historial de eventos de CloudTrail proporciona un registro visible e inmutable, que se puede buscar y descargar, de los últimos 90 días de eventos de gestión registrados en una Región de AWS. Para obtener más información, consulte Trabajar con el historial de eventos de CloudTrail en la Guía del usuario de AWS CloudTrail. No se cobran cargos de CloudTrail por ver el Historial de eventos.

Para mantener un registro permanente de los eventos en su Cuenta de AWS más allá de los 90 días, cree un registro de seguimiento o un almacén de datos de eventos de CloudTrail Lake.

Registros de seguimiento de CloudTrail

Un registro de seguimiento permite a CloudTrail enviar archivos de registro a un bucket de Amazon S3. Todos los registros de seguimiento que cree con la Consola de administración de AWS son multirregionales. Puede crear un registro de seguimiento de una sola región o multirregionales mediante la AWS CLI. Se recomienda crear un registro de seguimiento multirregional, ya que registra actividad en todas las Regiones de AWS de su cuenta. Si crea un registro de seguimiento de una sola región, solo podrá ver los eventos registrados en la Región de AWS del registro de seguimiento. Para obtener más información acerca de los registros de seguimiento, consulte Creación de un registro de seguimiento para su Cuenta de AWS y Creación de un registro de seguimiento para una organización en la Guía del usuario de AWS CloudTrail.

Puede crear un registro de seguimiento para enviar una copia de los eventos de administración en curso en su bucket de Amazon S3 sin costo alguno desde CloudTrail; sin embargo, hay cargos por almacenamiento en Amazon S3. Para obtener más información sobre los precios de CloudTrail, consulte Precios de AWS CloudTrail. Para obtener información acerca de los precios de Amazon S3, consulte Precios de Amazon S3.

Almacenes de datos de eventos de CloudTrail Lake

CloudTrail Lake le permite ejecutar consultas basadas en SQL sobre los eventos. CloudTrail Lake convierte los eventos existentes en formato JSON basado en filas al formato ORC de Apache. ORC es un formato de almacenamiento en columnas optimizado para una recuperación rápida de datos. Los eventos se agregan en almacenes de datos de eventos, que son recopilaciones inmutables de eventos en función de criterios que se seleccionan aplicando selectores de eventos avanzados. Los selectores que se aplican a un almacén de datos de eventos controlan los eventos que perduran y están disponibles para la consulta. Para obtener más información acerca de CloudTrail Lake, consulte Trabajar con AWS CloudTrail Lake en la Guía del usuario de AWS CloudTrail.

Los almacenes de datos de eventos de CloudTrail Lake y las consultas generan costos adicionales. Cuando crea un almacén de datos de eventos, debe elegir la opción de precios que desee utilizar para él. La opción de precios determina el costo de la incorporación y el almacenamiento de los eventos, así como el período de retención predeterminado y máximo del almacén de datos de eventos. Para obtener más información sobre los precios de CloudTrail, consulte Precios de AWS CloudTrail.

Eventos de administración de Amazon Managed Grafana en CloudTrail

Los eventos de administración proporcionan información sobre las operaciones de administración que se realizan en los recursos de su Cuenta de AWS. Se denominan también operaciones del plano de control. CloudTrail registra los eventos de administración de forma predeterminada.

Amazon Managed Grafana registra todas las operaciones del plano de control de Amazon Managed Grafana como eventos de administración. Para obtener una lista de las operaciones del plano de control de Amazon Managed Grafana que Amazon Managed Grafana registra en CloudTrail, consulte la referencia de la API de Amazon Managed Grafana.

Ejemplos de eventos de Amazon Managed Grafana

Un evento representa una única solicitud de cualquier origen e incluye información sobre la operación de la API solicitada, la fecha y la hora de la operación o los parámetros de la solicitud, entre otras cosas. Los archivos de registro de CloudTrail no rastrean el orden en la pila de las llamadas a la API públicas, por lo que los eventos no aparecen en un orden específico.

En el siguiente ejemplo, se muestra una entrada de registro de CloudTrail para una acción CreateWorkspace.

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "AssumedRole",
        "principalId": "ANPAJ2UCCR6DPCEXAMPLE:sdbt-example",
        "arn": "arn:aws:sts::123456789012:assumed-role/Admin/sdbt-example",
        "accountId": "123456789012",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "sessionContext": {
            "sessionIssuer": {
                "type": "Role",
                "principalId": "ANPAJ2UCCR6DPCEXAMPLE",
                "arn": "arn:aws:iam::123456789012:role/Admin",
                "accountId": "123456789012",
                "userName": "Admin"
            },
            "webIdFederationData": {},
            "attributes": {
                "mfaAuthenticated": "false",
                "creationDate": "2020-11-26T20:59:21Z"
            }
        }
    },
    "eventTime": "2020-11-26T21:10:48Z",
    "eventSource": "grafana.amazonaws.com",
    "eventName": "CreateWorkspace",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "205.251.233.179",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:82.0) Gecko/20100101 Firefox/82.0",
    "requestParameters": {
        "permissionType": "Service Managed",
        "workspaceNotificationDestinations": [
            "SNS"
        ],
        "workspaceDescription": "",
        "clientToken": "12345678-abcd-1234-5678-111122223333",
        "workspaceDataSources": [
            "SITEWISE",
            "XRAY",
            "CLOUDWATCH",
            "ELASTICSEARCH",
            "PROMETHEUS",
            "TIMESTREAM"
        ],
        "accountAccessType": "CURRENT_ACCOUNT",
        "workspaceName": "CloudTrailTest",
        "workspaceRoleArn": "arn:aws:iam::123456789012:role/service-role/AmazonGrafanaServiceRole-27O5976ol"
    },
    "responseElements": {
        "Access-Control-Expose-Headers": "x-amzn-RequestId,x-amzn-ErrorType,x-amzn-ErrorMessage,Date",
        "workspace": {
            "accountAccessType": "CURRENT_ACCOUNT",
            "created": 1606425045.22,
            "dataSources": [
                "SITEWISE",
                "XRAY",
                "CLOUDWATCH",
                "ELASTICSEARCH",
                "PROMETHEUS",
                "TIMESTREAM"
            ],
            "description": "",
            "grafanaVersion": "7.3.1",
            "id": "g-a187c473d3",
            "modified": 1606425045.22,
            "name": "CloudTrailTest",
            "notificationDestinations": [
                "SNS"
            ],
            "permissionType": "Service Managed",
            "status": "CREATING",
            "workspaceRoleArn": "arn:aws:iam::123456789012:role/service-role/AmazonGrafanaServiceRole-27O5976ol"
        }
    },
    "requestID": "12345678-5533-4e10-b486-e9c7b219f2fd",
    "eventID": "12345678-2710-4359-ad90-b902dbfb606b",
    "readOnly": false,
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "eventCategory": "Management",
    "recipientAccountId": "123456789012"
}

En el ejemplo siguiente se muestra una entrada de registro de CloudTrail para una acción UpdateWorkspaceAuthentication.

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "AssumedRole",
        "principalId": "AROAU2UJBF3NRO35YZ3GV:CODETEST_Series_GrafanaApiTestHydraCanary12-o6aeXqaXS_1090259374",
        "arn": "arn:aws:sts::332073610971:assumed-role/HydraInvocationRole-4912743f1277b7c3c67cb29518f8bc413ae/CODETEST_Series_GrafanaApiTestHydraCanary12-o6aeXqaXS_1090259374",
        "accountId": "111122223333",
        "accessKeyId": "AIDACKCEVSQ6C2EXAMPLE",
        "sessionContext": {
            "sessionIssuer": {
                "type": "Role",
                "principalId": "AROAU2UJBF3NRO35YZ3GV",
                "arn": "arn:aws:iam::111122223333:role/HydraInvocationRole-4912743f1277b7c3c67cb29518f8bc413ae",
                "accountId": "332073610971",
                "userName": "TestInvocationRole-4912743f1277b7c3c67cb29518f8bc413ae"
            },
            "webIdFederationData": {},
            "attributes": {
                "creationDate": "2021-08-04T20:50:24Z",
                "mfaAuthenticated": "false"
            }
        }
    },
    "eventTime": "2021-08-04T21:29:25Z",
    "eventSource": "gamma-grafana.amazonaws.com",
    "eventName": "UpdateWorkspaceAuthentication",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "34.215.72.249",
    "userAgent": "aws-internal/3 aws-sdk-java/1.11.1030 Linux/4.14.231-180.360.amzn2.x86_64 OpenJDK_64-Bit_Server_VM/11.0.11+9-LTS java/11.0.11 vendor/Amazon.com_Inc. cfg/retry-mode/legacy exec-env/AWS_Lambda_java11",
    "requestParameters": {
        "authenticationProviders": [
            "AWS_SSO",
            "SAML"
        ],
        "samlConfiguration": {
            "idpMetadata": {
                "url": "https://portal.sso.us-east-1.amazonaws.com/saml/metadata/NjMwMDg2NDc4OTA3X2lucy1jY2E2ZGU3ZDlmYjdiM2Vh"
            }
        },
        "workspaceId": "g-84ea23c1b4"
    },
    "responseElements": {
        "authentication": {
            "awsSso": {
                "ssoClientId": "gAROcWGs9-LoqCMIQ56XyEXAMPLE"
            },
            "providers": [
                "AWS_SSO",
                "SAML"
            ],
            "saml": {
                "configuration": {
                    "idpMetadata": {
                        "url": "https://portal.sso.us-east-1.amazonaws.com/saml/metadata/NjMwMDg2NDc4OTA3X2lucy1jY2E2ZGU3ZDlmYjdiM2Vh"
                    },
                    "loginValidityDuration": 60
                },
                "status": "CONFIGURED"
            }
        }
    },
    "requestID": "96adb1de-7fa5-487e-b6c6-6b0d4495cb71",
    "eventID": "406bc825-bc52-475c-9c91-4c0d8a07c1fa",
    "readOnly": false,
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "recipientAccountId": "111122223333",
    "eventCategory": "Management"
}

Para obtener información sobre el contenido de los registros de CloudTrail, consulte Contenido de los registros de CloudTrail en la Guía del usuario de AWS CloudTrail.

Ejemplos de eventos de la API de Grafana

Amazon Managed Grafana también registra algunas llamadas a la API de Grafana en CloudTrail. Las llamadas capturadas son las que modifican los datos, como las llamadas que crean, actualizan o eliminan recursos. Para obtener más información sobre las API de Grafana que son compatibles con Amazon Managed Grafana, consulte Uso de las API HTTP de Grafana.

El usuario inicia sesión en el espacio de trabajo de Amazon Managed Grafana mediante AWS IAM Identity Center

{
    "Records": [
        {
            "eventVersion": "1.08",
            "userIdentity": {
                "type": "SAMLUser",
                "userName": "johndoe"
            },
            "eventTime": "2021-07-09T02:31:59Z",
            "eventSource": "grafana.amazonaws.com",
            "eventName": "login-auth.sso",
            "awsRegion": "us-west-2",
            "sourceIPAddress": "192.0.2.0,198.51.100.0",
            "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36",
            "requestParameters": null,
            "responseElements": null,
            "eventID": "176bf326-0302-4190-8dbf-dfdf481d8198",
            "readOnly": false,
            "eventType": "AwsServiceEvent",
            "managementEvent": true,
            "eventCategory": "Management",
            "recipientAccountId": "111122223333",
            "serviceEventDetails": {
                "timestamp": "2021-07-09T02:31:59.045984031Z",
                "user": {
                    "userId": 1,
                    "orgId": 1,
                    "name": "johndoe",
                    "isAnonymous": false
                },
                "action": "login-auth.sso",
                "requestUri": "",
                "request": {
                    "query": {
                        "code": [
                            "eyJraWQiOiJrZXktMTU2Njk2ODEyMSIsImFsZyI6IkhTMzg0In0.eyJwbGFpbnRleHQiOiJZUzEwYWtaWHpBZUowTDlQcW5ROGFmZUw2YUZMRklPWUtkX2RRMmhmUUFFIiwiZXhwIjoxNjI1Nzk4MjE4LCJ0eXBlIjoiYXV0aENvZGUifQ.F6MCLvokeXFv1zEwaSg66wdfnNh0dEnLIKBZ4c1dhfNHX_XQywkSq3aqqUg4CsB7"
                        ],
                        "state": [
                            "QUFBQURtdGxlUzB4TlRZNE9UVTFOekkyM2RUWUFUaHZHYXcyOU9ULUVaWHhNUXAwX184N25RVGVWMmd0enFpVE1iWlRPV0M0X09HaDZscjcweDZNbUE3blRjamNISk9RQ2hCUktrY093ZW52aDNWZ2R5UXVndnc4R2g0RkxsamkwMGNvektWbS1KYWRVYnZ0X3AtSU5JRzIxZjFvcWgxN19vM0lPaW9vY1FBVlhLVmEzRE5CRjQxTU1fM3VmYzNWdW53aGZ0QVdFWHBUWTNWTkxrcllKQ3I1akFOUmV1Zlh4Y3ZjQi1XOEVMa0RPUFBqM094VGgta2hHdVFxSDB4YXZKMng"
                        ]
                    }
                },
                "result": {
                    "statusType": "failure"
                },
                "ipAddress": "192.0.2.0,198.51.100.0",
                "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36",
                "grafanaVersion": "7.5.7",
                "additionalData": {
                    "GiraffeCustomerAccount": "111122223333",
                    "GiraffeWorkspaceId": "g-123EXAMPLE",
                    "extUserInfo": "{\"OAuthToken\":null,\"AuthModule\":\"auth.sso\",\"AuthId\":\"92670be4c1-e524608b-82f2-452d-a707-161c1e5f4706\",\"UserId\":0,\"Email\":\"\",\"Login\":\"johndoe\",\"Name\":\"johndoe\",\"Groups\":null,\"OrgRoles\":{\"1\":\"Admin\"},\"IsGrafanaAdmin\":false,\"IsDisabled\":false}"
                }
            }
        }
    ]
}

API POST (Grafana) /api/auth/keys

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "Unknown",
        "userName": "api_key"
    },
    "eventTime": "2021-07-09T02:16:32Z",
    "eventSource": "grafana.amazonaws.com",
    "eventName": "create",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "192.0.2.0,198.51.100.1",
    "userAgent": "python-requests/2.24.0",
    "errorCode": "200",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "157bbf19-6ba4-4704-bc3b-d3e334b3a2b8",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "eventCategory": "Management",
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "timestamp": "2021-07-09T02:16:32.419795511Z",
        "user": {
            "orgId": 1,
            "orgRole": "Admin",
            "name": "api_key",
            "apiKeyId": "23",
            "isAnonymous": false
        },
        "action": "create",
        "resources": [
            {
                "ID": 0,
                "type": "api-key"
            }
        ],
        "requestUri": "",
        "request": {
            "body": "{\"name\":\"keyname\",\"role\":\"Admin\",\"secondsToLive\":60}"
        },
        "result": {
            "statusType": "success",
            "statusCode": "200"
        },
        "ipAddress": "192.0.2.0,198.51.100.1",
        "userAgent": "python-requests/2.24.0",
        "grafanaVersion": "7.5.7",
        "additionalData": {
            "GiraffeCustomerAccount": "111122223333",
            "GiraffeWorkspaceId": "g-123EXAMPLE"
        }
    }
}

API DELETE (Grafana) /api/auth/keys/:id

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "Unknown",
        "userName": "api_key"
    },
    "eventTime": "2021-07-09T02:16:33Z",
    "eventSource": "grafana.amazonaws.com",
    "eventName": "delete",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "192.0.2.0,198.51.100.2",
    "userAgent": "python-requests/2.24.0",
    "errorCode": "200",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "df1aafb3-28c6-4836-a64b-4d34538edc51",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "eventCategory": "Management",
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "timestamp": "2021-07-09T02:16:33.045041594Z",
        "user": {
            "orgId": 1,
            "orgRole": "Admin",
            "name": "api_key",
            "apiKeyId": "23",
            "isAnonymous": false
        },
        "action": "delete",
        "resources": [
            {
                "ID": 0,
                "type": "api-key"
            }
        ],
        "requestUri": "",
        "request": {
            "params": {
                ":id": "24"
            }
        },
        "result": {
            "statusType": "success",
            "statusCode": "200"
        },
        "ipAddress": "192.0.2.0,198.51.100.2",
        "userAgent": "python-requests/2.24.0",
        "grafanaVersion": "7.5.7",
        "additionalData": {
            "GiraffeCustomerAccount": "111122223333",
            "GiraffeWorkspaceId": "g-123EXAMPLE"
        }
    }
}

API POST (Grafana) /api/alerts/:id/pause

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "Unknown",
        "userName": "api_key"
    },
    "eventTime": "2021-07-09T02:16:40Z",
    "eventSource": "grafana.amazonaws.com",
    "eventName": "pause",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "192.0.2.0,198.51.100.3",
    "userAgent": "python-requests/2.24.0",
    "errorCode": "200",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "d533a7ba-f193-45ac-a88c-75ed0594509b",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "eventCategory": "Management",
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "timestamp": "2021-07-09T02:16:40.261226856Z",
        "user": {
            "orgId": 1,
            "orgRole": "Admin",
            "name": "api_key",
            "apiKeyId": "23",
            "isAnonymous": false
        },
        "action": "pause",
        "resources": [
            {
                "ID": 0,
                "type": "alert"
            }
        ],
        "requestUri": "",
        "request": {
            "params": {
                ":alertId": "1"
            },
            "body": "{\"paused\":true}"
        },
        "result": {
            "statusType": "success",
            "statusCode": "200"
        },
        "ipAddress": "192.0.2.0,198.51.100.3",
        "userAgent": "python-requests/2.24.0",
        "grafanaVersion": "7.5.7",
        "additionalData": {
            "GiraffeCustomerAccount": "111122223333",
            "GiraffeWorkspaceId": "g-123EXAMPLE"
        }
    }
}

POST (Grafana) /api/alerts/test

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "Unknown",
        "userName": "api_key"
    },
    "eventTime": "2021-07-09T02:16:39Z",
    "eventSource": "grafana.amazonaws.com",
    "eventName": "test",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "192.0.2.0,10.0.42.208",
    "userAgent": "python-requests/2.24.0",
    "errorCode": "400",
    "errorMessage": "The dashboard needs to be saved at least once before you can test an alert rule",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "7094644d-8230-4774-a092-8a128eb6dec9",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "eventCategory": "Management",
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "timestamp": "2021-07-09T02:16:39.622607860Z",
        "user": {
            "orgId": 1,
            "orgRole": "Admin",
            "name": "api_key",
            "apiKeyId": "23",
            "isAnonymous": false
        },
        "action": "test",
        "resources": [
            {
                "ID": 0,
                "type": "panel"
            }
        ],
        "requestUri": "",
        "request": {},
        "result": {
            "statusType": "failure",
            "statusCode": "400",
            "failureMessage": "The dashboard needs to be saved at least once before you test an alert rule"
        },
        "ipAddress": "192.0.2.0, 10.0.42.208",
        "userAgent": "python-requests/2.24.0",
        "grafanaVersion": "7.5.7",
        "additionalData": {
            "GiraffeCustomerAccount": "111122223333",
            "GiraffeWorkspaceId": "g-123EXAMPLE"
        }
    }
}

API POST (Grafana) /api/alert-notifications

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "Unknown",
        "userName": "api_key"
    },
    "eventTime": "2021-07-09T02:16:40Z",
    "eventSource": "grafana.amazonaws.com",
    "eventName": "create",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "192.0.2.0,198.51.100.0",
    "userAgent": "python-requests/2.24.0",
    "errorCode": "200",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "1ce099b3-c427-4338-9f42-d38d1ef64efe",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "eventCategory": "Management",
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "timestamp": "2021-07-09T02:16:40.888295790Z",
        "user": {
            "orgId": 1,
            "orgRole": "Admin",
            "name": "api_key",
            "apiKeyId": "23",
            "isAnonymous": false
        },
        "action": "create",
        "resources": [
            {
                "ID": 0,
                "type": "alert-notification"
            }
        ],
        "requestUri": "",
        "request": {
            "body": "{\"name\":\"alert notification name\",\"type\":\"Slack\"}"
        },
        "result": {
            "statusType": "success",
            "statusCode": "200"
        },
        "ipAddress": "192.0.2.0,198.51.100.0",
        "userAgent": "python-requests/2.24.0",
        "grafanaVersion": "7.5.7",
        "additionalData": {
            "GiraffeCustomerAccount": "111122223333",
            "GiraffeWorkspaceId": "g-123EXAMPLE"
        }
    }
}

API PUT (Grafana) /api/alert-notifications/uid/:uid

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "Unknown",
        "userName": "api_key"
    },
    "eventTime": "2021-07-09T02:16:42Z",
    "eventSource": "grafana.amazonaws.com",
    "eventName": "update",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "192.0.2.0,198.51.100.3",
    "userAgent": "python-requests/2.24.0",
    "errorCode": "200",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "cebfeb38-5007-495c-bd29-c8077797acac",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "eventCategory": "Management",
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "timestamp": "2021-07-09T02:16:42.792652648Z",
        "user": {
            "orgId": 1,
            "orgRole": "Admin",
            "name": "api_key",
            "apiKeyId": "23",
            "isAnonymous": false
        },
        "action": "update",
        "resources": [
            {
                "ID": 0,
                "type": "alert-notification"
            }
        ],
        "requestUri": "",
        "request": {
            "params": {
                ":uid": "WvDWDSinz"
            },
            "body": "{\"name\":\"DIFFERENT alert notification name\",\"type\":\"AWS SNS\"}"
        },
        "result": {
            "statusType": "success",
            "statusCode": "200"
        },
        "ipAddress": "192.0.2.0,198.51.100.3",
        "userAgent": "python-requests/2.24.0",
        "grafanaVersion": "7.5.7",
        "additionalData": {
            "GiraffeCustomerAccount": "111122223333",
            "GiraffeWorkspaceId": "g-123EXAMPLE"
        }
    }
}

API POST (Grafana) /api/annotations

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "Unknown",
        "userName": "api_key"
    },
    "eventTime": "2021-07-09T02:16:45Z",
    "eventSource": "grafana.amazonaws.com",
    "eventName": "create",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "192.0.2.0,198.51.100.1",
    "userAgent": "python-requests/2.24.0",
    "errorCode": "200",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "13bf3bef-966c-4913-a760-ade365a4a08f",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "eventCategory": "Management",
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "timestamp": "2021-07-09T02:16:45.394513179Z",
        "user": {
            "orgId": 1,
            "orgRole": "Admin",
            "name": "api_key",
            "apiKeyId": "23",
            "isAnonymous": false
        },
        "action": "create",
        "resources": [
            {
                "ID": 0,
                "type": "annotation"
            }
        ],
        "requestUri": "",
        "request": {
            "body": "{\"dashboardId\":36,\"panelId\":2,\"tags\":[\"tag1\",\"tag2\"],\"what\":\"Event Name\"}"
        },
        "result": {
            "statusType": "success",
            "statusCode": "200"
        },
        "ipAddress": "192.0.2.0,198.51.100.1",
        "userAgent": "python-requests/2.24.0",
        "grafanaVersion": "7.5.7",
        "additionalData": {
            "GiraffeCustomerAccount": "111122223333",
            "GiraffeWorkspaceId": "g-123EXAMPLE"
        }
    }
}

API DELETE (Grafana) /api/dashboards/uid/:uid

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "Unknown",
        "userName": "api_key"
    },
    "eventTime": "2021-07-09T02:17:09Z",
    "eventSource": "grafana.amazonaws.com",
    "eventName": "delete",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "192.0.2.0,198.51.100.7",
    "userAgent": "python-requests/2.24.0",
    "errorCode": "200",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "d6ad9134-5fbc-403c-a76d-4ed9a81065b6",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "eventCategory": "Management",
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "timestamp": "2021-07-09T02:17:09.200112003Z",
        "user": {
            "orgId": 1,
            "orgRole": "Admin",
            "name": "api_key",
            "apiKeyId": "23",
            "isAnonymous": false
        },
        "action": "delete",
        "resources": [
            {
                "ID": 0,
                "type": "dashboard"
            }
        ],
        "requestUri": "",
        "request": {
            "params": {
                ":uid": "GLzWvIi7z"
            }
        },
        "result": {
            "statusType": "success",
            "statusCode": "200"
        },
        "ipAddress": "192.0.2.0,198.51.100.7",
        "userAgent": "python-requests/2.24.0",
        "grafanaVersion": "7.5.7",
        "additionalData": {
            "GiraffeCustomerAccount": "111122223333",
            "GiraffeWorkspaceId": "g-123EXAMPLE"
        }
    }
}

API PUT (Grafana) /api/datasources/:datasourceId

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "Unknown",
        "userName": "api_key"
    },
    "eventTime": "2021-07-09T02:16:36Z",
    "eventSource": "grafana.amazonaws.com",
    "eventName": "update",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "192.0.2.0,10.0.108.94",
    "userAgent": "python-requests/2.24.0",
    "errorCode": "200",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "92877483-bdf6-44f5-803e-1ac8ad997113",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "eventCategory": "Management",
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "timestamp": "2021-07-09T02:16:36.918660585Z",
        "user": {
            "orgId": 1,
            "orgRole": "Admin",
            "name": "api_key",
            "apiKeyId": "23",
            "isAnonymous": false
        },
        "action": "update",
        "resources": [
            {
                "ID": 0,
                "type": "datasource"
            }
        ],
        "requestUri": "",
        "request": {
            "params": {
                ":id": "108"
            },
            "body": "{\"access\":\"proxy\",\"basicAuth\":false,\"name\":\"test_amp_datasource_NEW_name\",\"type\":\"Amazon Managed Prometheus\",\"url\":\"http://amp.amazonaws.com\"}"
        },
        "result": {
            "statusType": "success",
            "statusCode": "200"
        },
        "ipAddress": "192.0.2.0,10.0.108.94",
        "userAgent": "python-requests/2.24.0",
        "grafanaVersion": "7.5.7",
        "additionalData": {
            "GiraffeCustomerAccount": "111122223333",
            "GiraffeWorkspaceId": "g-123EXAMPLE"
        }
    }
}

API DELETE (Grafana) /api/teams/:teamId/groups/:groupId

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "Unknown",
        "userName": "api_key"
    },
    "eventTime": "2021-07-09T02:17:07Z",
    "eventSource": "grafana.amazonaws.com",
    "eventName": "delete",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "192.0.2.0,198.51.100.2",
    "userAgent": "python-requests/2.24.0",
    "errorCode": "200",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "b41d3967-daab-44d1-994a-a437556add82",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "eventCategory": "Management",
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "timestamp": "2021-07-09T02:17:07.296142539Z",
        "user": {
            "orgId": 1,
            "orgRole": "Admin",
            "name": "api_key",
            "apiKeyId": "23",
            "isAnonymous": false
        },
        "action": "delete",
        "resources": [
            {
                "ID": 0,
                "type": "team"
            }
        ],
        "requestUri": "",
        "request": {
            "params": {
                ":groupId": "cn=editors,ou=groups,dc=grafana,dc=org",
                ":teamId": "35"
            }
        },
        "result": {
            "statusType": "success",
            "statusCode": "200"
        },
        "ipAddress": "192.0.2.0,198.51.100.2",
        "userAgent": "python-requests/2.24.0",
        "grafanaVersion": "7.5.7",
        "additionalData": {
            "GiraffeCustomerAccount": "111122223333",
            "GiraffeWorkspaceId": "g-123EXAMPLE"
        }
    }
}

API PUT (Grafana) /api/folders/:uid

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "Unknown",
        "userName": "api_key"
    },
    "eventTime": "2021-07-09T02:16:56Z",
    "eventSource": "grafana.amazonaws.com",
    "eventName": "update",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "192.0.2.0,198.51.100.1",
    "userAgent": "python-requests/2.24.0",
    "errorCode": "412",
    "errorMessage": "the folder has been changed by someone else",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "414c98c8-aa53-45e4-940d-bea55716eaf6",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "eventCategory": "Management",
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "timestamp": "2021-07-09T02:16:56.382646826Z",
        "user": {
            "orgId": 1,
            "orgRole": "Admin",
            "name": "api_key",
            "apiKeyId": "23",
            "isAnonymous": false
        },
        "action": "update",
        "resources": [
            {
                "ID": 0,
                "type": "folder"
            }
        ],
        "requestUri": "",
        "request": {
            "params": {
                ":uid": "lnsZvSi7z"
            },
            "body": "{\"title\":\"NEW Folder Name\"}"
        },
        "result": {
            "statusType": "failure",
            "statusCode": "412",
            "failureMessage": "the folder has been changed by someone else"
        },
        "ipAddress": "192.0.2.0,198.51.100.1",
        "userAgent": "python-requests/2.24.0",
        "grafanaVersion": "7.5.7",
        "additionalData": {
            "GiraffeCustomerAccount": "111122223333",
            "GiraffeWorkspaceId": "g-123EXAMPLE"
        }
    }
}

API POST (Grafana) /api/teams

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "Unknown",
        "userName": "api_key"
    },
    "eventTime": "2021-07-09T02:17:02Z",
    "eventSource": "grafana.amazonaws.com",
    "eventName": "create",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "192.0.2.0,10.0.40.206",
    "userAgent": "python-requests/2.24.0",
    "errorCode": "200",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "8d40bd79-76a8-490c-b7bb-74205253b707",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "eventCategory": "Management",
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "timestamp": "2021-07-09T02:17:02.845022379Z",
        "user": {
            "orgId": 1,
            "orgRole": "Admin",
            "name": "api_key",
            "apiKeyId": "23",
            "isAnonymous": false
        },
        "action": "create",
        "resources": [
            {
                "ID": 0,
                "type": "team"
            }
        ],
        "requestUri": "",
        "request": {
            "body": "{\"name\":\"TeamName\"}"
        },
        "result": {
            "statusType": "success",
            "statusCode": "200"
        },
        "ipAddress": "192.0.2.0,10.0.40.206",
        "userAgent": "python-requests/2.24.0",
        "grafanaVersion": "7.5.7",
        "additionalData": {
            "GiraffeCustomerAccount": "111122223333",
            "GiraffeWorkspaceId": "g-123EXAMPLE"
        }
    }
}