AWS Systems Manager Incident Manager 不再開放給新客戶。現有客戶可以繼續正常使用該服務。如需詳細資訊，請參閱AWS Systems Manager Incident Manager 可用性變更。

本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

匯出 Incident Manager 資料

本主題說明如何使用 Python 指令碼從 匯出事件記錄和事件後分析 AWS Systems Manager Incident Manager。指令碼會將資料匯出至結構化 JSON 檔案，以供進一步分析或存檔之用。

您可以匯出的內容

指令碼匯出下列資料：

先決條件

開始之前，請確定您已：

所需的 IAM 許可

若要使用此指令碼，請確定您有下列許可：

Systems Manager Incidents 許可

{
    "Version": "2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ssm-incidents:ListIncidentRecords",
                "ssm-incidents:GetIncidentRecord",
                "ssm-incidents:ListTimelineEvents",
                "ssm-incidents:GetTimelineEvent",
                "ssm-incidents:ListRelatedItems",
                "ssm-incidents:ListEngagements",
                "ssm-incidents:GetEngagement",
                "ssm-incidents:BatchGetIncidentFindings",
                "ssm-incidents:ListTagsForResource"
            ],
            "Resource": "*"
        }
    ]
}

Systems Manager 許可

{
    "Version": "2012-10-17",		 	 	 
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ssm:ListDocuments",
                "ssm:GetDocument",
                "ssm:GetAutomationExecution"
            ],
            "Resource": "*"
        }
    ]
}

匯出結構

指令碼會為匯出的資料建立下列目錄結構：

incident_manager_export_YYYYMMDD_HHMMSS/
├── incident_records/
│   ├── 20250309_102129_IAD_Service_A_Lambda_High_Latency.json
│   ├── 20250314_114820_SecurityFinding_SecurityHubFindings.json
│   └── ...
└── post_incident_analyses/
    ├── 20250310_143022_Root_Cause_Analysis_Service_A.json
    ├── 20250315_091545_Security_Incident_Review.json
    └── ...

執行匯出指令碼

基本使用

Incident Manager 資料匯出指令碼提供 here。請下載指令碼，並使用下列指示來執行指令碼。

若要使用預設設定執行指令碼：

python3 export-incident-manager-data.py

可用選項

您可以使用下列命令列選項來自訂匯出：

範例

使用自訂設定檔從特定區域匯出：

python3 export-incident-manager-data.py --region us-east-1 --profile my-aws-profile

使用詳細記錄和限制匯出以進行測試：

python3 export-incident-manager-data.py --verbose --limit 5 --timeline-events-limit 10

使用大型資料集的保守限制匯出：

python3 export-incident-manager-data.py --timeline-events-limit 50 --timeline-details-limit 25

輸出檔案結構

事件記錄 JSON 結構

每個事件記錄檔案都包含下列結構：

{
    "incident_record": {
        // Complete incident record from get-incident-record
    },
    "incident_summary": {
        // Incident summary from list-incident-records
    },
    "incident_source_details": {
        "from_incident_record": {},
        "from_incident_summary": {},
        "enhanced_details": {
            "created_by": "arn:aws:sts::...",
            "source": "aws.ssm-incidents.custom",
            "source_analysis": {
                "source_type": "manual",
                "creation_method": "human_via_console",
                "automation_involved": false,
                "human_created": true
            }
        }
    },
    "timeline_events": {
        "detailed_events": [
            {
                "summary": {}, // From list-timeline-events
                "details": {}  // From get-timeline-event
            }
        ],
        "summary_only_events": [],
        "metadata": {
            "total_events_found": 45,
            "events_with_details": 25,
            "limits_applied": {}
        }
    },
    "related_items": {
        "items": [],
        "metadata": {}
    },
    "engagements": {
        "engagements": [],
        "metadata": {}
    },
    "automation_executions": [],
    "findings": [],
    "tags": [],
    "post_incident_analysis": {
        "analysis_reference": {},
        "metadata": {}
    },
    "export_metadata": {
        "exported_at": "2025-09-18T...",
        "region": "us-east-*",
        "incident_arn": "arn:aws:ssm-incidents::..."
    }
}

事件後分析 JSON 結構

每個分析文件檔案都包含：

{
    "document_metadata": {
        // Document metadata from list-documents
    },
    "document_details": {
        "Name": "037fc5dd-cd86-49bb-9c3d-15720e78798e",
        "Content": "...", // Full JSON content
        "DocumentType": "ProblemAnalysis",
        "CreatedDate": 1234567890,
        "ReviewStatus": "APPROVED",
        "AttachmentsContent": [],
        // ... other fields from get-document
    },
    "export_metadata": {
        "exported_at": "2025-09-18T...",
        "region": "us-east-*",
        "document_name": "..."
    }
}