開啟資源追蹤

在 https：//https://console.aws.amazon.com/backup 開啟 AWS Backup 主控台。

在左側導覽窗格中，選擇 Audit Manager 下的 架構。

選擇 管理資源追蹤 以開啟資源追蹤。

選擇移至 AWS Config 設定。

選擇 啟用或停用記錄。

選擇 啟用 記錄下列所有資源類型，或選擇啟用記錄部分資源類型。請參閱 AWS Backup Audit Manager 控制項與修補，瞭解控制項需要的資源類型。

選擇關閉。

等待顯示開啟資源追蹤的藍色橫幅，轉換成顯示已開啟資源追蹤的綠色橫幅。

輸入以下命令，確定是否已啟用 AWS Config 記錄器。

$ aws configservice describe-configuration-recorders

1. 如果您的 ConfigurationRecorders 清單空白如下：

   {
     "ConfigurationRecorders": []
   }

   您的記錄器未啟用。請繼續步驟 2 建立您的記錄器。

2. 如已啟用記錄所有資源，您的 ConfigurationRecorders 輸出結果會如下所示：

   {
     "ConfigurationRecorders":[
       {
         "recordingGroup":{
           "allSupported":true,
           "resourceTypes":[
             
           ],
           "includeGlobalResourceTypes":true
         },
         "roleARN":"arn:aws:iam::[account]:role/[roleName]",
         "name":"default"
       }
     ]
   }

   因為您已啟用所有已開啟資源追蹤的資源。您不需要完成此程序的其餘部分，即可使用 AWS Backup Audit Manager。

使用 AWS Backup Audit Manager 資源類型建立 AWS Config 記錄器

$ aws configservice put-configuration-recorder --configuration-recorder name=default, \
roleARN=arn:aws:iam::accountId:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig \ 
--recording-group resourceTypes="['AWS::Backup::BackupPlan','AWS::Backup::BackupSelection', \
'AWS::Backup::BackupVault','AWS::Backup::RecoveryPoint']"

描述您的 AWS Config 記錄器。

$ aws configservice describe-configuration-recorders

比較您的輸出與下列預期輸出，以確認其具有 AWS Backup Audit Manager 資源類型。

{
  "ConfigurationRecorders":[
    {
      "name":"default",
      "roleARN":"arn:aws:iam::accountId:role/AWSServiceRoleForConfig",
      "recordingGroup":{
        "allSupported":false,
        "includeGlobalResourceTypes":false,
        "resourceTypes":[
          "AWS::Backup::BackupPlan",
          "AWS::Backup::BackupSelection",
          "AWS::Backup::BackupVault",
          "AWS::Backup::RecoveryPoint"
        ]
      }
    }
  ]
}

建立 Amazon S3 儲存貯體做為儲存 AWS Config 組態檔案的目的地。

$ aws s3api create-bucket --bucket amzn-s3-demo-bucket —region us-east-1

使用 policy.json 授予存取儲存貯體的 AWS Config 許可。請參閱下列範例 policy.json。

$ aws s3api put-bucket-policy --bucket amzn-s3-demo-bucket --policy file://policy.json

{
  "Version":"2012-10-17",
  "Statement":[
    {
      "Sid":"AWSConfigBucketPermissionsCheck",
      "Effect":"Allow",
      "Principal":{
        "Service":"config.amazonaws.com"
      },
      "Action":"s3:GetBucketAcl",
      "Resource":"arn:aws:s3:::amzn-s3-demo-bucket"
    },
    {
      "Sid":"AWSConfigBucketExistenceCheck",
      "Effect":"Allow",
      "Principal":{
        "Service":"config.amazonaws.com"
      },
      "Action":"s3:ListBucket",
      "Resource":"arn:aws:s3:::amzn-s3-demo-bucket"
    },
    {
      "Sid":"AWSConfigBucketDelivery",
      "Effect":"Allow",
      "Principal":{
        "Service":"config.amazonaws.com"
      },
      "Action":"s3:PutObject",
      "Resource":"arn:aws:s3:::amzn-s3-demo-bucket/*"
    }
  ]
}

將儲存貯體設定為 AWS Config 交付管道

$ aws configservice put-delivery-channel --delivery-channel name=default,s3BucketName=amzn-s3-demo-bucket

啟用 AWS Config 錄製

$ aws configservice start-configuration-recorder --configuration-recorder-name default

確認 DescribeFramework 輸出最後一行中的 "FrameworkStatus":"ACTIVE" 如下所示。

$ aws backup describe-framework --framework-name test --region us-east-1

{
  "FrameworkName":"test",
 "FrameworkArn":"arn:aws:backup:us-east-1:accountId:framework:test-f0001b0a-0000-1111-ad3d-4444f5cc6666",
  "FrameworkDescription":"",
  "FrameworkControls":[
    {
      "ControlName":"BACKUP_RECOVERY_POINT_MINIMUM_RETENTION_CHECK",
      "ControlInputParameters":[
        {
          "ParameterName":"requiredRetentionDays",
          "ParameterValue":"1"
        }
      ],
      "ControlScope":{
        
      }
    },
    {
      "ControlName":"BACKUP_PLAN_MIN_FREQUENCY_AND_MIN_RETENTION_CHECK",
      "ControlInputParameters":[
        {
          "ParameterName":"requiredFrequencyUnit",
          "ParameterValue":"hours"
        },
        {
          "ParameterName":"requiredRetentionDays",
          "ParameterValue":"35"
        },
        {
          "ParameterName":"requiredFrequencyValue",
          "ParameterValue":"1"
        }
      ],
      "ControlScope":{
        
      }
    },
    {
      "ControlName":"BACKUP_RESOURCES_PROTECTED_BY_BACKUP_PLAN",
      "ControlInputParameters":[
        
      ],
      "ControlScope":{
        
      }
    },
    {
      "ControlName":"BACKUP_RECOVERY_POINT_ENCRYPTED",
      "ControlInputParameters":[
        
      ],
      "ControlScope":{
        
      }
    },
    {
      "ControlName":"BACKUP_RECOVERY_POINT_MANUAL_DELETION_DISABLED",
      "ControlInputParameters":[
        
      ],
      "ControlScope":{
        
      }
    }
  ],
  "CreationTime":1633463605.233,
  "DeploymentStatus":"COMPLETED",
  "FrameworkStatus":"ACTIVE"
}