View a markdown version of this page

使用 记录 API 调用 AWS CloudTrail 适合 AWS Organizations - AWS Organizations
AWS Organizations 中的信息 CloudTrail了解 AWS Organizations 日志文件条目

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

使用 记录 API 调用 AWS CloudTrail 适合 AWS Organizations

AWS Organizations 与 AWS CloudTrail一项服务集成，该服务提供用户、角色或 AWS 服务在中执行的操作的记录 AWS Organizations。 CloudTrail 将所有 API 调用捕获 AWS Organizations 为事件，包括来自 AWS Organizations 控制台的调用和对 AWS Organizations API 的代码调用。如果您创建跟踪，则可以启用向 Amazon S3 存储桶持续交付事件，包括的事件 AWS Organizations。 CloudTrail 如果您未配置跟踪，仍可以在 CloudTrail 控制台的事件历史记录中查看最新事件。使用收集的信息 CloudTrail，您可以确定向谁发出的请求 AWS Organizations、发出的请求的 IP 地址、发出的人、提出请求的时间以及其他详细信息。

要了解更多信息 CloudTrail，请参阅《AWS CloudTrail 用户指南》。

重要

您 AWS Organizations 只能查看美国东部（弗吉尼亚北部）地区的所有 CloudTrail 信息。如果您在 CloudTrail 主机中看不到自己的 AWS Organizations 活动，请使用右上角的菜单将您的主机设置为美国东部（弗吉尼亚北部）。如果您使用 AWS CLI 或 SDK 工具 CloudTrail 进行查询，请将查询定向到美国东部（弗吉尼亚北部）终端节点。

AWS Organizations 中的信息 CloudTrail

CloudTrail 在您创建帐户 AWS 账户 时已在您的上启用。当活动发生在中时 AWS Organizations，该活动将与 CloudTrail 事件历史记录中的其他 AWS 服务事件一起记录在事件中。您可以在中查看、搜索和下载最近的事件 AWS 账户。有关更多信息，请参阅使用事件历史记录查看 CloudTrail 事件。

对于 AWS 账户中的事件的持续记录（包括 AWS Organizations的事件），请创建跟踪记录。跟踪可以 CloudTrail 将日志文件传输到 Amazon S3 存储桶。在您的中启用 CloudTrail 日志记录后 AWS 账户，对 AWS Organizations 操作的 API 调用将在 CloudTrail 日志文件中进行跟踪，这些调用将与其他 AWS 服务记录一起写入。您可以 AWS 服务 将其他配置为进一步分析和处理 CloudTrail 日志中收集的事件数据。有关更多信息，请参阅下列内容：

所有 AWS Organizations 操作均由 API 参考记录 CloudTrail 并记录在 AWS Organizations API 参考中。例如，调用CreateAccount（包括CreateAccountResult事件）ListHandshakesForAccountCreatePolicy、和会在 CloudTrail 日志文件中InviteAccountToOrganization生成条目。

每个日志条目都包含有关生成请求的人员的信息。日志条目中的用户身份信息可帮助您确定以下内容：

  • 请求是使用根用户凭证还是 IAM 用户凭证发出的

  • 请求是使用 IAM 角色还是联合身份用户的临时安全凭证发出的

  • 请求是否由其他 AWS 服务提出

有关更多信息，请参阅 CloudTrail userIdentity 元素。

注意

CloudTrail 将在采取给定操作的账户中记录事件（例如，如果成员账户采取了操作，则记录在成员账户而不是管理账户中）。例如，离开组织的成员账户将登录到成员账户跟踪中，而移除成员账户的管理账户将登录到管理账户追踪中。

了解 AWS Organizations 日志文件条目

跟踪是一种配置，它允许将事件作为日志文件传输到您指定的 Amazon S3 存储桶。 CloudTrail 日志文件包含一个或多个日志条目。一个事件表示来自任何源的一个请求，包括有关所请求的操作、操作的日期和时间、请求参数等方面的信息。 CloudTrail 日志文件不是公用 API 调用的有序堆栈跟踪，因此它们不会以任何特定顺序显示。

示例日志条目： CloseAccount

以下示例显示了CloseAccount调用 API 且关闭账户的工作流程在后台开始处理时生成的示例调用的 CloudTrail 日志条目。

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "AIDAMVNPBQA3EXAMPLE:my-admin-role",
        "arn": "arn:aws:sts::111122223333:assumed-role/my-admin-role/my-session-id",
        "accountId": "111122223333",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "sessionContext": {
            "sessionIssuer": {
                "type": "Role",
                "principalId": "AIDAMVNPBQA3EXAMPLE",
                "arn": "arn:aws:iam::111122223333:role/my-admin-role",
                "accountId": "111122223333",
                "userName": "my-session-id"
            },
            "webIdFederationData": {},
            "attributes": {
                "mfaAuthenticated": "false",
                "creationDate": "2022-03-18T18:17:06Z"
            }
        }
    },
    "eventTime": "2022-03-18T18:17:06Z",
    "eventSource": "organizations.amazonaws.com",
    "eventName": "CloseAccount",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "192.168.0.1",
    "userAgent":  "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)...",
    "requestParameters": {
        "accountId": "555555555555"
    },
    "responseElements": null,
    "requestID": "e28932f8-d5da-4d7a-8238-ef74f3d5c09a",
    "eventID": "19fe4c10-f57e-4cb7-a2bc-6b5c30233592",
    "readOnly": false,
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "recipientAccountId": "111122223333",
    "eventCategory": "Management"
}

以下示例显示了关闭账户的后台工作流程成功完成后的CloseAccountResult呼叫 CloudTrail 日志条目。

{
  "eventVersion": "1.08",
  "userIdentity": {
    "accountId": "111122223333",
    "invokedBy": "organizations.amazonaws.com"
  },
  "eventTime": "2022-03-18T18:17:06Z",
  "eventSource": "organizations.amazonaws.com",
  "eventName": "CloseAccountResult",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "organizations.amazonaws.com",
  "userAgent": "organizations.amazonaws.com",
  "requestParameters": null,
  "responseElements": null,
  "eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
  "readOnly": false,
  "eventType": "AwsServiceEvent",
  "readOnly": false,
  "eventType": "AwsServiceEvent",
  "managementEvent": true,
  "recipientAccountId": "111122223333",
  "serviceEventDetails": {
    "closeAccountStatus": {
      "accountId": "555555555555",
      "state": "SUCCEEDED",
      "requestedTimestamp": "Mar 18, 2022 6:16:58 PM",
      "completedTimestamp": "Mar 18, 2022 6:16:58 PM"
    }
   },
   "eventCategory": "Management"
}

示例日志条目： CreateAccount

以下示例显示了示例CreateAccount调用的 CloudTrail 日志条目，该调用是在调用 API 且创建账户的工作流程在后台开始处理时生成的。

{
    "eventVersion": "1.05",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "AIDAMVNPBQA3EXAMPLE:my-admin-role",
        "arn": "arn:aws:sts::111122223333:assumed-role/my-admin-role/my-session-id",
        "accountId": "111122223333",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "sessionContext": {
            "sessionIssuer": {
                "type": "Role",
                "principalId": "AIDAMVNPBQA3EXAMPLE",
                "arn": "arn:aws:iam::111122223333:role/my-admin-role",
                "accountId": "111122223333",
                "userName": "my-session-id"
            },
            "webIdFederationData": {},
            "attributes": {
                "mfaAuthenticated": "false",
                "creationDate": "2020-09-16T21:16:45Z"
            }
        }
    },
    "eventTime": "2018-06-21T22:06:27Z",
    "eventSource": "organizations.amazonaws.com",
    "eventName": "CreateAccount",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "192.168.0.1",
    "userAgent":  "Mozilla/5.0 (Windows NT 10.0; Win64; x64)...",
    "requestParameters": {
        "tags": [],
        "email": "****",
        "accountName": "****"
    },
    "responseElements": {
        "createAccountStatus": {
            "accountName": "****",
            "state": "IN_PROGRESS",
            "id": "car-examplecreateaccountrequestid111",
            "requestedTimestamp": "Sep 16, 2020 9:20:50 PM"
        }
    },
    "requestID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
    "eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
    "eventType": "AwsApiCall",
    "recipientAccountId": "111111111111"
}

以下示例显示了创建账户的后台工作流程成功完成后的CreateAccount呼叫 CloudTrail 日志条目。

{
  "eventVersion": "1.05",
  "userIdentity": {
    "accountId": "111122223333",
    "invokedBy": "..."
  },
  "eventTime": "2020-09-16T21:20:53Z",
  "eventSource": "organizations.amazonaws.com",
  "eventName": "CreateAccountResult",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "192.0.2.0",
  "userAgent": "....",
  "requestParameters": null,
  "responseElements": null,
  "eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
  "readOnly": false,
  "eventType": "AwsServiceEvent",
  "recipientAccountId": "111122223333",
  "serviceEventDetails": {
    "createAccountStatus": {
      "id": "car-examplecreateaccountrequestid111",
      "state": "SUCCEEDED",
      "accountName": "****",
      "accountId": "444455556666",
      "requestedTimestamp": "Sep 16, 2020 9:20:50 PM",
      "completedTimestamp": "Sep 16, 2020 9:20:53 PM"
    }
  }
}

以下示例显示了在后CreateAccount台工作流程无法创建账户后生成的 CloudTrail 日志条目。


  {
  "eventVersion": "1.06",
  "userIdentity": {
    "accountId": "111122223333",
    "invokedBy": "AWS Internal"
  },
  "eventTime": "2018-06-21T22:06:27Z",
  "eventSource": "organizations.amazonaws.com",
  "eventName": "CreateAccountResult",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "AWS Internal",
  "userAgent": "AWS Internal",
  "requestParameters": null,
  "responseElements": null,
  "eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
  "readOnly": false,
  "eventType": "AwsServiceEvent",
  "recipientAccountId": "111122223333",
  "serviceEventDetails": {
    "createAccountStatus": {
      "id": "car-examplecreateaccountrequestid111",
      "state": "FAILED",
      "accountName": "****",
      "failureReason": "EMAIL_ALREADY_EXISTS",
      "requestedTimestamp": Jun 21, 2018 10:06:27 PM,
      "completedTimestamp": Jun 21, 2018 10:07:15 PM
    }
  }
}

示例日志条目： AcceptResponsibilityTransfer

当 AWS Organizations 接受账单责任转移时，它会向每个受影响的账户发布ResponsibilityTransferAccepted服务事件。对于链式转账， AWS Organizations 还会通知上游参与者。该transferChain字段列出了从已接受的传输到受影响最大的上游传输的受影响转移 ID。

以下示例显示了 AWS Organizations 接受下游转移 (rt-5ipg3ess) 后传送到上游分销商账户 (111122223333) 的 CloudTrail 日志条目。该transferChain字段包括接受的传输和受影响的上游传输 (rt-9zpzuocg)。

{
    "eventVersion": "1.11",
    "userIdentity": {
        "type": "AWSService",
        "invokedBy": "AWS Internal"
    },
    "eventTime": "2026-08-12T19:50:27Z",
    "eventSource": "organizations.amazonaws.com",
    "eventName": "ResponsibilityTransferAccepted",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "AWS Internal",
    "userAgent": "AWS Internal",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "111122223333",
    "sharedEventID": "EXAMPLEa-121c-425d-bb01-1d94aEXAMPLE",
    "serviceEventDetails": {
        "id": "rt-5ipg3ess",
        "transferChain": [
            "rt-5ipg3ess",
            "rt-9zpzuocg"
        ],
        "type": "BILLING",
        "status": "ACCEPTED",
        "source": {
            "managementAccountId": "555555555555"
        },
        "target": {
            "managementAccountId": "444455556666"
        },
        "requester": "555555555555",
        "startTimestamp": 1790812800000
    },
    "eventCategory": "Management"
}

示例日志条目： TerminateResponsibilityTransfer

账单责任转移结束后，向每个受影响的账户 AWS Organizations 发布ResponsibilityTransferTerminated服务事件。对于链式转账，分销商等上游参与者也会收到通知。该transferChain字段列出了从已终止的传输到受影响最大的上游传输的受影响转移 ID。

以下示例显示了 AWS Organizations 终止下游传输 (rt-5ipg3ess) 后传送到上游分销商账户 (111122223333) 的 CloudTrail 日志条目。该transferChain字段包括终止的传输和受影响的上游传输 (rt-9zpzuocg)。

{
    "eventVersion": "1.11",
    "userIdentity": {
        "type": "AWSService",
        "invokedBy": "AWS Internal"
    },
    "eventTime": "2026-08-12T18:17:06Z",
    "eventSource": "organizations.amazonaws.com",
    "eventName": "ResponsibilityTransferTerminated",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "AWS Internal",
    "userAgent": "AWS Internal",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "111122223333",
    "sharedEventID": "EXAMPLEa-121c-425d-bb01-1d94aEXAMPLE",
    "serviceEventDetails": {
        "id": "rt-5ipg3ess",
        "transferChain": [
            "rt-5ipg3ess",
            "rt-9zpzuocg"
        ],
        "type": "BILLING",
        "status": "WITHDRAWN",
        "source": {
            "managementAccountId": "444455556666"
        },
        "target": {
            "managementAccountId": "555555555555"
        },
        "requester": "444455556666",
        "startTimestamp": 1790812800000,
        "endTimestamp": 1790812800000
    },
    "eventCategory": "Management"
}

示例日志条目： CreateOrganizationalUnit

以下示例显示了示例CreateOrganizationalUnit呼叫的 CloudTrail 日志条目。

{
    "eventVersion": "1.05",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "AIDAMVNPBQA3EXAMPLE",
        "arn": "arn:aws:iam::111111111111:user/diego",
        "accountId": "111111111111",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "userName": "diego"
    },
    "eventTime": "2017-01-18T21:40:11Z",
    "eventSource": "organizations.amazonaws.com",
    "eventName": "CreateOrganizationalUnit",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "192.0.2.0",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.95 Safari/537.36",
    "requestParameters": {
        "name": "OU-Developers-1",
        "parentId": "r-a1b2"
    },
    "responseElements": {
        "organizationalUnit": {
            "arn": "arn:aws:organizations::111111111111:ou/o-aa111bb222/ou-examplerootid111-exampleouid111",
            "id": "ou-examplerootid111-exampleouid111",
            "name": "test-cloud-trail",
            "path": "o-aa111bb222/r-a1b2/ou-examplerootid111-exampleouid111/"
        }
    },
    "requestID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
    "eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
    "eventType": "AwsApiCall",
    "recipientAccountId": "111111111111"
}

示例日志条目： InviteAccountToOrganization

以下示例显示了示例InviteAccountToOrganization呼叫的 CloudTrail 日志条目。

{
    "eventVersion": "1.05",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "AIDAMVNPBQA3EXAMPLE",
        "arn": "arn:aws:iam::111111111111:user/diego",
        "accountId": "111111111111",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "userName": "diego"
    },
    "eventTime": "2017-01-18T21:41:17Z",
    "eventSource": "organizations.amazonaws.com",
    "eventName": "InviteAccountToOrganization",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "192.0.2.0",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.95 Safari/537.36",
    "requestParameters": {
        "notes": "This is a request for Mary's account to join Diego's organization.",
        "target": {
            "type": "ACCOUNT",
            "id": "111111111111"
        }
    },
    "responseElements": {
        "handshake": {
            "requestedTimestamp": "Jan 18, 2017 9:41:16 PM",
            "state": "OPEN",
            "arn": "arn:aws:organizations::111111111111:handshake/o-aa111bb222/invite/h-examplehandshakeid111",
            "id": "h-examplehandshakeid111",
            "parties": [
                {
                    "type": "ORGANIZATION",
                    "id": "o-aa111bb222"
                },
                {
                    "type": "ACCOUNT",
                    "id": "222222222222"
                }
            ],
            "action": "invite",
            "expirationTimestamp": "Feb 2, 2017 9:41:16 PM",
            "resources": [
                {
                    "resources": [
                        {
                            "type": "MASTER_EMAIL",
                            "value": "diego@example.com"
                        },
                        {
                            "type": "MASTER_NAME",
                            "value": "Management account for organization"
                        },
                        {
                            "type": "ORGANIZATION_FEATURE_SET",
                            "value": "ALL"
                        }
                    ],
                    "type": "ORGANIZATION",
                    "value": "o-aa111bb222"
                },
                {
                    "type": "ACCOUNT",
                    "value": "222222222222"
                },
                {
                    "type": "NOTES",
                    "value": "This is a request for Mary's account to join Diego's organization."
                }
            ]
        }
    },
    "requestID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
    "eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
    "eventType": "AwsApiCall",
    "recipientAccountId": "111111111111"
}

示例日志条目： AttachPolicy

以下示例显示了示例AttachPolicy呼叫的 CloudTrail 日志条目。该响应指示，在请求尝试附加到的根中，由于请求的策略类型未启用，调用失败。

{
    "eventVersion": "1.06",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "AIDAMVNPBQA3EXAMPLE",
        "arn": "arn:aws:iam::111111111111:user/diego",
        "accountId": "111111111111",
        "accessKeyId": "AKIAIOSFODNN7EXAMPLE",
        "userName": "diego"
    },
    "eventTime": "2017-01-18T21:42:44Z",
    "eventSource": "organizations.amazonaws.com",
    "eventName": "AttachPolicy",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "192.0.2.0",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.95 Safari/537.36",
    "errorCode": "PolicyTypeNotEnabledException",
    "errorMessage": "The given policy type ServiceControlPolicy is not enabled on the current view",
    "requestParameters": {
        "policyId": "p-examplepolicyid111",
        "targetId": "ou-examplerootid111-exampleouid111"
    },
    "responseElements": null,
    "requestID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
    "eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
    "eventType": "AwsApiCall",
    "recipientAccountId": "111111111111"
}

示例日志条目：无效的有效策略

以下示例显示了示例EffectivePolicyValidation事件的 CloudTrail 日志条目。每当组织中的更新导致任何账户创建了无效的有效政策时，就会向组织的管理账户发送此事件。

{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "111122223333",
        "invokedBy": "AWS Internal"
    },
    "eventTime": "2025-07-17T14:53:40Z",
    "eventSource": "organizations.amazonaws.com",
    "eventName": "EffectivePolicyValidation",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "AWS Internal",
    "userAgent": "AWS Internal",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
    "readOnly": true,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "111111111111",
    "serviceEventDetails": {
        "accountId": "111111111111",
        "policyType": "BACKUP_POLICY",
        "state": "INVALID",
        "requestTimestamp": "Jul 17, 2025, 2:53:40 PM",
        "info": "All validation errors listed",
        "validationErrors": [
            {
                "accountPath": "o-aa111bb222/r-a1b2/111111111111/",
                "evaluationTimestamp": "Jul 17, 2025, 2:53:40 PM",
                "errorCode": "ELEMENTS_TOO_MANY",
                "errorMessage": "'hourly_rule' exceeds the allowed maximum limit 10",
                "pathToError": "plans/hourly-backup/rules/hourly_rule",
                "contributingPolicies": [
                    "p-examplepolicyid111"
                ]
            }
        ]
    },
    "eventCategory": "Management"
}

示例日志条目：有效的有效策略

以下示例显示了示例EffectivePolicyValidation事件的 CloudTrail 日志条目。每当组织中的更新修复了账户中之前无效的有效策略时，就会向组织的管理账户发送此事件。

{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "111111111111",
        "invokedBy": "AWS Internal"
    },
    "eventTime": "2025-07-17T14:54:40Z",
    "eventSource": "organizations.amazonaws.com",
    "eventName": "EffectivePolicyValidation",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "AWS Internal",
    "userAgent": "AWS Internal",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
    "readOnly": true,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "111111111111",
    "serviceEventDetails": {
        "accountId": "111111111111",
        "policyType": "BACKUP_POLICY",
        "state": "VALID",
        "requestTimestamp": "Jul 17, 2025, 2:54:40 PM",
        "info": "Previous effective policy validation error(s) resolved for this account/policyType"
    },
    "eventCategory": "Management"
}