本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
# 使用 for 记录 API AWS CloudTrail 调用 AWS Organizations
AWS Organizations 与 AWS CloudTrail一项服务集成，该服务提供用户、角色或 AWS 服务在中执行的操作的记录 AWS Organizations。 CloudTrail 将所有 API 调用捕获 AWS Organizations 为事件，包括来自 AWS Organizations 控制台的调用和对的代码调用 AWS Organizations APIs。如果您创建了跟踪，则可以允许将 CloudTrail 事件持续传输到 Amazon S3 存储桶，包括的事件 AWS Organizations。如果您未配置跟踪，您仍然可以在 CloudTrail 控制台的 “事件**历史记录” 中查看最新的事件**。使用收集到的信息 CloudTrail，您可以确定向哪个请求发出 AWS Organizations、发出的 IP 地址、谁发出、何时发出以及其他详细信息。
要了解更多信息 CloudTrail，请参阅《*AWS CloudTrail 用户指南》*。
**重要**
您 AWS Organizations 只能查看美国东部（弗吉尼亚北部）区域的所有 CloudTrail 信息。如果您在 CloudTrail 主机中看不到自己的 AWS Organizations 活动，请使用右上角的菜单将您的主机设置为**美国东部（弗吉尼亚北部）**。如果您使用 AWS CLI 或 SDK 工具 CloudTrail 进行查询，请将查询定向到美国东部（弗吉尼亚北部）终端节点。
## AWS Organizations 信息在 CloudTrail
CloudTrail 在您创建账户 AWS 账户 时已在您的账户上启用。当活动发生在中时 AWS Organizations，该活动会与其他 AWS 服务 CloudTrail 事件一起记录在**事件历史**记录中。您可以在中查看、搜索和下载最近发生的事件 AWS 账户。有关更多信息，请参阅[使用事件历史记录查看 CloudTrail 事件](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html)。
对于 AWS 账户中的事件的持续记录（包括 AWS Organizations的事件），请创建跟踪记录。跟踪允许 CloudTrail 将日志文件传输到 Amazon S3 存储桶。在您的中启用 CloudTrail 日志记录后 AWS 账户，对 AWS Organizations 操作进行的 API 调用将在 CloudTrail 日志文件中进行跟踪，这些调用与其他 AWS 服务记录一起写入日志文件。您可以配置其他 AWS 服务 ，以进一步分析和处理 CloudTrail 日志中收集的事件数据。有关更多信息，请参阅下列内容：
+ [创建跟踪概述](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html)
+ [CloudTrail 支持的服务和集成](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-aws-service-specific-topics.html#cloudtrail-aws-service-specific-topics-integrations)
+ [配置 Amazon SNS 通知 CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/getting_notifications_top_level.html)
所有 AWS Organizations 操作均由《API 参考》记录 CloudTrail 并记录在《[AWS Organizations API 参考](https://docs.aws.amazon.com/organizations/latest/APIReference/)》中。例如，调用`CreateAccount`（包括`CreateAccountResult`事件）、`ListHandshakesForAccount``CreatePolicy`、和`InviteAccountToOrganization`会在 CloudTrail 日志文件中生成条目。
每个日志条目都包含有关生成请求的人员的信息。日志条目中的用户身份信息可帮助您确定以下内容：
+ 请求是使用根用户凭证还是 IAM 用户凭证发出的
+ 请求是使用 [IAM 角色](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html)还是[联合身份用户](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers.html)的临时安全凭证发出的
+ 请求是否由其他 AWS 服务发出
有关更多信息，请参阅 [CloudTrail userIdentity 元素](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html)。
**注意**
CloudTrail 将在执行给定操作的账户中记录事件（即，如果成员账户采取了行动，则记录在成员账户中，而不是在管理账户中）。例如，离开组织的成员账户将记录在成员账户跟踪中，而删除成员账户的管理账户将记录在管理账户跟踪中。
## 了解 AWS Organizations 日志文件条目
跟踪是一种配置，允许将事件作为日志文件传输到您指定的 Amazon S3 存储桶。 CloudTrail 日志文件包含一个或多个日志条目。一个事件表示来自任何源的一个请求，包括有关所请求的操作、操作的日期和时间、请求参数等方面的信息。 CloudTrail 日志文件不是公用 API 调用的有序堆栈跟踪，因此它们不会以任何特定顺序显示。
### 日志条目示例： CloseAccount
以下示例显示了调用 API 时生成的示例`CloseAccount`调用的 CloudTrail 日志条目，该条目是在后台开始处理关闭账户的工作流程时生成的。
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "AIDAMVNPBQA3EXAMPLE:my-admin-role",
"arn": "arn:aws:sts::111122223333:assumed-role/my-admin-role/my-session-id",
"accountId": "111122223333",
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"sessionContext": {
"sessionIssuer": {
"type": "Role",
"principalId": "AIDAMVNPBQA3EXAMPLE",
"arn": "arn:aws:iam::111122223333:role/my-admin-role",
"accountId": "111122223333",
"userName": "my-session-id"
},
"webIdFederationData": {},
"attributes": {
"mfaAuthenticated": "false",
"creationDate": "2022-03-18T18:17:06Z"
}
}
},
"eventTime": "2022-03-18T18:17:06Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "CloseAccount",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.168.0.1",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)...",
"requestParameters": {
"accountId": "555555555555"
},
"responseElements": null,
"requestID": "e28932f8-d5da-4d7a-8238-ef74f3d5c09a",
"eventID": "19fe4c10-f57e-4cb7-a2bc-6b5c30233592",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
以下示例显示了成功完成关闭账户的后台工作流程之后`CloseAccountResult`呼叫的 CloudTrail 日志条目。
```
{
"eventVersion": "1.08",
"userIdentity": {
"accountId": "111122223333",
"invokedBy": "organizations.amazonaws.com"
},
"eventTime": "2022-03-18T18:17:06Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "CloseAccountResult",
"awsRegion": "us-east-1",
"sourceIPAddress": "organizations.amazonaws.com",
"userAgent": "organizations.amazonaws.com",
"requestParameters": null,
"responseElements": null,
"eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"readOnly": false,
"eventType": "AwsServiceEvent",
"readOnly": false,
"eventType": "AwsServiceEvent",
"managementEvent": true,
"recipientAccountId": "111122223333",
"serviceEventDetails": {
"closeAccountStatus": {
"accountId": "555555555555",
"state": "SUCCEEDED",
"requestedTimestamp": "Mar 18, 2022 6:16:58 PM",
"completedTimestamp": "Mar 18, 2022 6:16:58 PM"
}
},
"eventCategory": "Management"
}
```
### 日志条目示例： CreateAccount
以下示例显示了`CreateAccount`调用 API 且创建账户的工作流程在后台开始处理时生成的示例调用的 CloudTrail 日志条目。
```
{
"eventVersion": "1.05",
"userIdentity": {
"type": "IAMUser",
"principalId": "AIDAMVNPBQA3EXAMPLE:my-admin-role",
"arn": "arn:aws:sts::111122223333:assumed-role/my-admin-role/my-session-id",
"accountId": "111122223333",
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"sessionContext": {
"sessionIssuer": {
"type": "Role",
"principalId": "AIDAMVNPBQA3EXAMPLE",
"arn": "arn:aws:iam::111122223333:role/my-admin-role",
"accountId": "111122223333",
"userName": "my-session-id"
},
"webIdFederationData": {},
"attributes": {
"mfaAuthenticated": "false",
"creationDate": "2020-09-16T21:16:45Z"
}
}
},
"eventTime": "2018-06-21T22:06:27Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "CreateAccount",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.168.0.1",
"userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)...",
"requestParameters": {
"tags": [],
"email": "****",
"accountName": "****"
},
"responseElements": {
"createAccountStatus": {
"accountName": "****",
"state": "IN_PROGRESS",
"id": "car-examplecreateaccountrequestid111",
"requestedTimestamp": "Sep 16, 2020 9:20:50 PM"
}
},
"requestID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"eventType": "AwsApiCall",
"recipientAccountId": "111111111111"
}
```
以下示例显示了创建账户的后台工作流程成功完成后的`CreateAccount`呼叫 CloudTrail 日志条目。
```
{
"eventVersion": "1.05",
"userIdentity": {
"accountId": "111122223333",
"invokedBy": "..."
},
"eventTime": "2020-09-16T21:20:53Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "CreateAccountResult",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "....",
"requestParameters": null,
"responseElements": null,
"eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"readOnly": false,
"eventType": "AwsServiceEvent",
"recipientAccountId": "111122223333",
"serviceEventDetails": {
"createAccountStatus": {
"id": "car-examplecreateaccountrequestid111",
"state": "SUCCEEDED",
"accountName": "****",
"accountId": "444455556666",
"requestedTimestamp": "Sep 16, 2020 9:20:50 PM",
"completedTimestamp": "Sep 16, 2020 9:20:53 PM"
}
}
}
```
以下示例显示了在后`CreateAccount`台工作流程无法创建帐户后生成的 CloudTrail 日志条目。
```
{
"eventVersion": "1.06",
"userIdentity": {
"accountId": "111122223333",
"invokedBy": "AWS Internal"
},
"eventTime": "2018-06-21T22:06:27Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "CreateAccountResult",
"awsRegion": "us-east-1",
"sourceIPAddress": "AWS Internal",
"userAgent": "AWS Internal",
"requestParameters": null,
"responseElements": null,
"eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"readOnly": false,
"eventType": "AwsServiceEvent",
"recipientAccountId": "111122223333",
"serviceEventDetails": {
"createAccountStatus": {
"id": "car-examplecreateaccountrequestid111",
"state": "FAILED",
"accountName": "****",
"failureReason": "EMAIL_ALREADY_EXISTS",
"requestedTimestamp": Jun 21, 2018 10:06:27 PM,
"completedTimestamp": Jun 21, 2018 10:07:15 PM
}
}
}
```
### 日志条目示例： CreateOrganizationalUnit
以下示例显示了示例`CreateOrganizationalUnit`调用的 CloudTrail 日志条目。
```
{
"eventVersion": "1.05",
"userIdentity": {
"type": "IAMUser",
"principalId": "AIDAMVNPBQA3EXAMPLE",
"arn": "arn:aws:iam::111111111111:user/diego",
"accountId": "111111111111",
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"userName": "diego"
},
"eventTime": "2017-01-18T21:40:11Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "CreateOrganizationalUnit",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.95 Safari/537.36",
"requestParameters": {
"name": "OU-Developers-1",
"parentId": "r-a1b2"
},
"responseElements": {
"organizationalUnit": {
"arn": "arn:aws:organizations::111111111111:ou/o-aa111bb222/ou-examplerootid111-exampleouid111",
"id": "ou-examplerootid111-exampleouid111",
"name": "test-cloud-trail",
"path": "o-aa111bb222/r-a1b2/ou-examplerootid111-exampleouid111/"
}
},
"requestID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"eventType": "AwsApiCall",
"recipientAccountId": "111111111111"
}
```
### 日志条目示例： InviteAccountToOrganization
以下示例显示了示例`InviteAccountToOrganization`调用的 CloudTrail 日志条目。
```
{
"eventVersion": "1.05",
"userIdentity": {
"type": "IAMUser",
"principalId": "AIDAMVNPBQA3EXAMPLE",
"arn": "arn:aws:iam::111111111111:user/diego",
"accountId": "111111111111",
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"userName": "diego"
},
"eventTime": "2017-01-18T21:41:17Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "InviteAccountToOrganization",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.95 Safari/537.36",
"requestParameters": {
"notes": "This is a request for Mary's account to join Diego's organization.",
"target": {
"type": "ACCOUNT",
"id": "111111111111"
}
},
"responseElements": {
"handshake": {
"requestedTimestamp": "Jan 18, 2017 9:41:16 PM",
"state": "OPEN",
"arn": "arn:aws:organizations::111111111111:handshake/o-aa111bb222/invite/h-examplehandshakeid111",
"id": "h-examplehandshakeid111",
"parties": [
{
"type": "ORGANIZATION",
"id": "o-aa111bb222"
},
{
"type": "ACCOUNT",
"id": "222222222222"
}
],
"action": "invite",
"expirationTimestamp": "Feb 2, 2017 9:41:16 PM",
"resources": [
{
"resources": [
{
"type": "MASTER_EMAIL",
"value": "diego@example.com"
},
{
"type": "MASTER_NAME",
"value": "Management account for organization"
},
{
"type": "ORGANIZATION_FEATURE_SET",
"value": "ALL"
}
],
"type": "ORGANIZATION",
"value": "o-aa111bb222"
},
{
"type": "ACCOUNT",
"value": "222222222222"
},
{
"type": "NOTES",
"value": "This is a request for Mary's account to join Diego's organization."
}
]
}
},
"requestID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"eventType": "AwsApiCall",
"recipientAccountId": "111111111111"
}
```
### 日志条目示例： AttachPolicy
以下示例显示了示例`AttachPolicy`调用的 CloudTrail 日志条目。该响应指示，在请求尝试附加到的根中，由于请求的策略类型未启用，调用失败。
```
{
"eventVersion": "1.06",
"userIdentity": {
"type": "IAMUser",
"principalId": "AIDAMVNPBQA3EXAMPLE",
"arn": "arn:aws:iam::111111111111:user/diego",
"accountId": "111111111111",
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"userName": "diego"
},
"eventTime": "2017-01-18T21:42:44Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "AttachPolicy",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.95 Safari/537.36",
"errorCode": "PolicyTypeNotEnabledException",
"errorMessage": "The given policy type ServiceControlPolicy is not enabled on the current view",
"requestParameters": {
"policyId": "p-examplepolicyid111",
"targetId": "ou-examplerootid111-exampleouid111"
},
"responseElements": null,
"requestID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"eventType": "AwsApiCall",
"recipientAccountId": "111111111111"
}
```
### 示例日志条目：无效的有效策略
以下示例显示了示例`EffectivePolicyValidation`事件的 CloudTrail 日志条目。每当组织中的更新导致任何账户创建了无效的有效政策时，就会向组织的管理账户发送此事件。
```
{
"eventVersion": "1.11",
"userIdentity": {
"accountId": "111122223333",
"invokedBy": "AWS Internal"
},
"eventTime": "2025-07-17T14:53:40Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "EffectivePolicyValidation",
"awsRegion": "us-east-1",
"sourceIPAddress": "AWS Internal",
"userAgent": "AWS Internal",
"requestParameters": null,
"responseElements": null,
"eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"readOnly": true,
"eventType": "AwsServiceEvent",
"managementEvent": true,
"recipientAccountId": "111111111111",
"serviceEventDetails": {
"accountId": "111111111111",
"policyType": "BACKUP_POLICY",
"state": "INVALID",
"requestTimestamp": "Jul 17, 2025, 2:53:40 PM",
"info": "All validation errors listed",
"validationErrors": [
{
"accountPath": "o-aa111bb222/r-a1b2/111111111111/",
"evaluationTimestamp": "Jul 17, 2025, 2:53:40 PM",
"errorCode": "ELEMENTS_TOO_MANY",
"errorMessage": "'hourly_rule' exceeds the allowed maximum limit 10",
"pathToError": "plans/hourly-backup/rules/hourly_rule",
"contributingPolicies": [
"p-examplepolicyid111"
]
}
]
},
"eventCategory": "Management"
}
```
### 示例日志条目：有效的有效策略
以下示例显示了示例`EffectivePolicyValidation`事件的 CloudTrail 日志条目。每当组织中的更新修复了账户中之前无效的有效策略时，就会向组织的管理账户发送此事件。
```
{
"eventVersion": "1.11",
"userIdentity": {
"accountId": "111111111111",
"invokedBy": "AWS Internal"
},
"eventTime": "2025-07-17T14:54:40Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "EffectivePolicyValidation",
"awsRegion": "us-east-1",
"sourceIPAddress": "AWS Internal",
"userAgent": "AWS Internal",
"requestParameters": null,
"responseElements": null,
"eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"readOnly": true,
"eventType": "AwsServiceEvent",
"managementEvent": true,
"recipientAccountId": "111111111111",
"serviceEventDetails": {
"accountId": "111111111111",
"policyType": "BACKUP_POLICY",
"state": "VALID",
"requestTimestamp": "Jul 17, 2025, 2:54:40 PM",
"info": "Previous effective policy validation error(s) resolved for this account/policyType"
},
"eventCategory": "Management"
}
```