本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。 # 使用 AWS CloudTrail 记录 Step Functions API 调用 AWS Step Functions 与 [AWS CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html) 集成，后者是提供用户、角色或 AWS 服务 所执行操作记录的服务。CloudTrail 将 Step Functions 的所有 API 调用作为事件捕获。捕获的调用包含来自 Step Functions 控制台的调用和对 Step Functions API 操作的代码调用。借助通过 CloudTrail 收集的信息，可以确定向 Step Functions 发出了哪些请求、从中发出请求的 IP 地址、请求的发出时间以及其它详细信息。 每个事件或日志条目都包含有关生成请求的人员信息。身份信息有助于您确定以下内容： + 请求是使用根用户凭证还是用户凭证发出的。 + 请求是否代表 IAM Identity Center 用户发出。 + 请求是使用角色还是联合用户的临时安全凭证发出的。 + 请求是否由其他 AWS 服务 发出。 当您创建账户并可以自动访问 CloudTrail **事件历史记录**时，CloudTrail 在您的 AWS 账户 中处于活动状态。CloudTrail **事件历史记录**提供对 AWS 区域 中过去 90 天的已记录管理事件的可查看、可搜索、可下载和不可变记录。有关更多信息，请参见《AWS CloudTrail 用户指南》的 [使用 CloudTrail 事件历史记录](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html)**。查看**事件历史记录**不会收取 CloudTrail 费用。 要持续记录您的 AWS 账户 过去 90 天的事件，请创建跟踪或 [CloudTrail Lake](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake.html) 事件数据存储。 **CloudTrail 跟踪** 通过*跟踪记录*，CloudTrail 可将日志文件传送至 Simple Storage Service (Amazon S3) 存储桶。使用 AWS 管理控制台 创建的所有跟踪均具有多区域属性。您可以通过使用 AWS CLI 创建单区域或多区域跟踪。建议创建多区域跟踪，因为您可记录您账户中的所有 AWS 区域 的活动。如果您创建单区域跟踪，则只能查看跟踪的 AWS 区域 中记录的事件。有关跟踪的更多信息，请参阅《AWS CloudTrail 用户指南》**中的[为您的 AWS 账户 创建跟踪](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html)和[为组织创建跟踪](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/creating-trail-organization.html)。 通过创建跟踪，您可以从 CloudTrail 免费向您的 Amazon S3 存储桶传送一份正在进行的管理事件的副本，但会收取 Amazon S3 存储费用。有关 CloudTrail 定价的更多信息，请参阅 [AWS CloudTrail 定价](https://aws.amazon.com/cloudtrail/pricing/)。有关 Amazon S3 定价的信息，请参阅 [Amazon S3 定价](https://aws.amazon.com/s3/pricing/)。 **CloudTrail Lake 事件数据存储** *CloudTrail Lake* 允许您对事件运行基于 SQL 的查询。CloudTrail Lake 可将基于行的 JSON 格式的现有事件转换为 [Apache ORC](https://orc.apache.org/) 格式。ORC 是一种针对快速检索数据进行优化的列式存储格式。事件将被聚合到*事件数据存储*中，它是基于您通过应用[高级事件选择器](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake-concepts.html#adv-event-selectors)选择的条件的不可变的事件集合。应用于事件数据存储的选择器用于控制哪些事件持续存在并可供您查询。有关 CloudTrail Lake 的更多信息，请参阅《AWS CloudTrail 用户指南》**中的[使用 AWS CloudTrail Lake](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake.html)。 CloudTrail Lake 事件数据存储和查询会产生费用。创建事件数据存储时，您可以选择要用于事件数据存储的[定价选项](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-lake-manage-costs.html#cloudtrail-lake-manage-costs-pricing-option)。定价选项决定了摄取和存储事件的成本，以及事件数据存储的默认和最长保留期。有关 CloudTrail 定价的更多信息，请参阅 [AWS CloudTrail 定价](https://aws.amazon.com/cloudtrail/pricing/)。 ## CloudTrail 中的数据事件 [数据事件](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#logging-data-events)可提供对资源或在资源中所执行资源操作（例如，读取或写入 Amazon S3 对象）的相关信息。这些也称为数据层面操作。数据事件通常是高容量活动。默认情况下，CloudTrail 不记录数据事件。CloudTrail **事件历史记录**不记录数据事件。 记录数据事件将收取额外费用。有关 CloudTrail 定价的更多信息，请参阅 [AWS CloudTrail 定价](https://aws.amazon.com/cloudtrail/pricing/)。 可以使用 CloudTrail 控制台、AWS CLI 或 CloudTrail API 操作来记录 Step Functions 资源类型的数据事件。有关如何记录数据事件的更多信息，请参阅《AWS CloudTrail 用户指南》**中的[使用 AWS 管理控制台 记录数据事件](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#logging-data-events-console)和[使用 AWS Command Line Interface 记录数据事件](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#creating-data-event-selectors-with-the-AWS-CLI)。 下表列出了可以记录其数据事件的 Step Functions 资源类型。**数据事件类型**列显示可从 CloudTrail 控制台上的**数据事件类型**列表中选择的值。**resources.type 值**列显示了您在使用 AWS CLI 或 CloudTrail API 配置高级事件选择器时需要指定的 `resources.type` 值。**记录到 CloudTrail 的数据 API** 列显示了针对该资源类型记录到 CloudTrail 的 API 调用。 您可以将高级事件选择器配置为在 `eventName`、`readOnly` 和 `resources.ARN` 字段上进行筛选，从而仅记录那些对您很重要的事件。有关这些字段的更多信息，请参阅《AWS CloudTrail API 参考》**中的 [https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedFieldSelector.html](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedFieldSelector.html)。 | 数据事件类型 | resources.type 值 | 记录至 CloudTrail 的数据 API | | --- | --- | --- | | Step Functions 状态机 | AWS::StepFunctions::StateMachine | [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/zh_cn/step-functions/latest/dg/procedure-cloud-trail.html) | | Step Functions 活动 | AWS::StepFunctions::Activity | [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/zh_cn/step-functions/latest/dg/procedure-cloud-trail.html) | ## CloudTrail 中的管理事件 [管理事件](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-management-events-with-cloudtrail.html#logging-management-events)提供对您 AWS 账户 内的资源所执行管理操作的相关信息。这些也称为控制面板操作。默认情况下，CloudTrail 会记录管理事件。 **状态机** + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_CreateStateMachine.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_CreateStateMachine.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListStateMachines.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListStateMachines.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeStateMachine.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeStateMachine.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_UpdateStateMachine.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_UpdateStateMachine.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_DeleteStateMachine.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_DeleteStateMachine.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_ValidateStateMachineDefinition.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_ValidateStateMachineDefinition.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_TestState.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_TestState.html) **状态机别名** + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_CreateStateMachineAlias.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_CreateStateMachineAlias.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListStateMachineAliases.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListStateMachineAliases.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeStateMachineAlias.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeStateMachineAlias.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_UpdateStateMachineAlias.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_UpdateStateMachineAlias.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_DeleteStateMachineAlias.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_DeleteStateMachineAlias.html) **状态机版本** + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListStateMachineVersions.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListStateMachineVersions.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_PublishStateMachineVersion.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_PublishStateMachineVersion.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_DeleteStateMachineVersion.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_DeleteStateMachineVersion.html) **执行** + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_StartExecution.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_StartExecution.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_StartSyncExecution.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_StartSyncExecution.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_RedriveExecution.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_RedriveExecution.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListExecutions.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListExecutions.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeExecution.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeExecution.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_GetExecutionHistory.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_GetExecutionHistory.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeStateMachineForExecution.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeStateMachineForExecution.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_StopExecution.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_StopExecution.html) **活动** + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_CreateActivity.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_CreateActivity.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListActivities.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListActivities.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeActivity.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeActivity.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_DeleteActivity.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_DeleteActivity.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_GetActivityTask.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_GetActivityTask.html) **任务令牌** + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_SendTaskSuccess.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_SendTaskSuccess.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_SendTaskHeartbeat.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_SendTaskHeartbeat.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_SendTaskFailure.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_SendTaskFailure.html) **MapRun** + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListMapRuns.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListMapRuns.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeMapRun.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_DescribeMapRun.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_UpdateMapRun.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_UpdateMapRun.html) ** 标签** + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListTagsForResource.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_ListTagsForResource.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_TagResource.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_TagResource.html) + [https://docs.aws.amazon.com/step-functions/latest/apireference/API_UntagResource.html](https://docs.aws.amazon.com/step-functions/latest/apireference/API_UntagResource.html) ## 事件示例 一个事件表示一个来自任何源的请求，包括有关所请求的 API 操作、操作的日期和时间、请求参数等方面的信息。CloudTrail 日志文件不是公用 API 调用的有序堆栈跟踪，因此事件不会按任何特定顺序显示。 下面的示例展示了一个演示 `InvokeHTTPEndpoint` 的 CloudTrail **数据事件**。 ``` { "eventVersion": "1.09", "userIdentity": { "accountId": "account-id", "invokedBy": "states.amazonaws.com" }, "eventTime": "2024-05-01T01:23:45Z", "eventSource": "states.amazonaws.com", "eventName": "InvokeHTTPEndpoint", "awsRegion": "us-east-1", "sourceIPAddress": "states.amazonaws.com", "userAgent": "states.amazonaws.com", "requestParameters": null, "responseElements": null, "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLEaaaaa", "readOnly": false, "resources": [ { "accountId": "account-id", "type": "AWS::StepFunctions::StateMachine", "ARN": "arn:aws:states:region:account-id:stateMachine:ExampleStateMachine" } ], "eventType": "AwsServiceEvent", "managementEvent": false, "recipientAccountId": "account-id", "serviceEventDetails": { "httpMethod": "GET", "httpEndpoint": "https://example.com" }, "eventCategory": "Data" } ``` 以下示例显示了一个演示 `CreateStateMachine` 操作的 CloudTrail **管理事件**。 ``` { "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "AIDAJYDLDBVBI4EXAMPLE", "arn": "arn:aws:iam::account-id:user/test-user", "accountId": "account-id", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName": "test-user" }, "eventTime": "2024-05-01T01:23:45Z", "eventSource": "states.amazonaws.com", "eventName": "CreateStateMachine", "awsRegion": "region", "sourceIPAddress": "AWS Internal", "userAgent": "AWS Internal", "requestParameters": { "name": "MyStateMachine", "definition": "HIDDEN_DUE_TO_SECURITY_REASONS", "roleArn": "arn:aws:iam::account-id:role/MyStateMachineRole", "type": "STANDARD", "loggingConfiguration": { "level": "OFF", "includeExecutionData": false }, "tags": [], "tracingConfiguration": { "enabled": false }, "publish": false }, "responseElements": { "stateMachineArn": "arn:aws:states:region:account-id:stateMachine:MyStateMachine", "creationDate": "May 1, 2024 1:23:45 AM" }, "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLEaaaaa", "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111", "readOnly": false, "eventType": "AwsApiCall", "managementEvent": true, "recipientAccountId": "account-id", "eventCategory": "Management" } ``` 有关 CloudTrail 记录内容的信息，请参阅《AWS CloudTrail 用户指南》**中的 [CloudTrail 记录内容](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-record-contents.html)。