View a markdown version of this page

为 Amazon Bedrock AgentCore Gateway 资源启用 CloudTrail 数据事件记录 - Amazon Bedrock AgentCore

为 Amazon Bedrock AgentCore Gateway 资源启用 CloudTrail 数据事件记录

您可以使用 CloudTrail 数据事件来获取有关 Amazon Bedrock AgentCore Gateway 请求的信息。要为 Gateway 启用 CloudTrail 数据事件，您必须在 Amazon S3 存储桶 CloudTrail 支持下手动创建跟踪。

重要注意事项

  • 数据事件记录会产生额外费用。您必须明确启用数据事件，因为默认情况下不会捕获这些事件。检查以确保您的账户启用了数据事件。

  • 使用生成高工作负载的网关，您可以在短时间内快速生成数千条日志。请注意您选择为繁忙的网关启用 CloudTrail 数据事件多长时间。

  • CloudTrail 将网关数据事件日志存储在您选择的 Amazon S3 存储桶中。考虑在单独的 AWS 账户中使用存储桶，以便更好地将来自多个资源的事件组织到一个中心位置，以便于查询和分析。

在中记录跟踪的数据事件时 CloudTrail，必须使用高级事件选择器来记录网关操作的数据事件。

例
AWS CLI

  1. 要使用 AWS CLI 为网关资源启用 CloudTrail 数据事件，可以在终端中运行以下命令：

    aws cloudtrail put-event-selectors \
  --trail-name brac-gateway-canary-trail-prod-us-east-1 \
  --region us-east-1 \
  --advanced-event-selectors '[
    {
      "Name": "GatewayDataEvents",
      "FieldSelectors": [
        {
          "Field": "eventCategory",
          "Equals": ["Data"]
        },
        {
          "Field": "resources.type",
          "Equals": ["AWS::BedrockAgentCore::Gateway"]
        }
      ]
    }
  ]'
AWS CDK

  1. 以下示例演示如何使用 AWS CDK 创建包含 AgentCore 网关数据事件的 CloudTrail 跟踪：

    import { Construct } from 'constructs';
import { Trail, CfnTrail } from 'aws-cdk-lib/aws-cloudtrail';
import { Bucket } from 'aws-cdk-lib/aws-s3';
import { Effect, PolicyStatement, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
import { RemovalPolicy } from 'aws-cdk-lib';

export interface DataEventTrailProps {
  /**
   * Whether to enable multi-region trail
   */
  isMultiRegionTrail?: boolean;

  /**
   * Whether to include global service events
   */
  includeGlobalServiceEvents?: boolean;

  /**
   * AWS region
   */
  region: string;

  /**
   * Environment account ID
   */
  account: string;
}

/**
 * Creates a CloudTrail trail configured to capture data events for Bedrock Agent Core Gateway
 */
export class BedrockAgentCoreDataEventTrail extends Construct {
  /**
   * The CloudTrail trail
   */
  public readonly trail: Trail;

  /**
   * The S3 bucket for CloudTrail logs
   */
  public readonly logsBucket: Bucket;

  constructor(scope: Construct, id: string, props: DataEventTrailProps) {
    super(scope, id);

    // Create S3 bucket for CloudTrail logs
    const bucketName = `brac-gateway-cloudtrail-logs-${props.account}-${props.region}`;
    this.logsBucket = new Bucket(this, 'CloudTrailLogsBucket', {
      bucketName,
      removalPolicy: RemovalPolicy.RETAIN,
    });

    // Create trail name (suffixing region since regional trail)
    const trailName = `brac-gateway-trail-${props.region}`;

    // Add CloudTrail bucket policy
    this.logsBucket.addToResourcePolicy(
      new PolicyStatement({
        sid: 'AWSCloudTrailAclCheck',
        effect: Effect.ALLOW,
        principals: [new ServicePrincipal('cloudtrail.amazonaws.com')],
        actions: ['s3:GetBucketAcl'],
        resources: [this.logsBucket.bucketArn],
        conditions: {
          StringEquals: {
            'aws:SourceArn': `arn:aws:cloudtrail:${props.region}:${props.account}:trail/${trailName}`,
          },
        },
      }),
    );

    this.logsBucket.addToResourcePolicy(
      new PolicyStatement({
        sid: 'AWSCloudTrailWrite',
        effect: Effect.ALLOW,
        principals: [new ServicePrincipal('cloudtrail.amazonaws.com')],
        actions: ['s3:PutObject'],
        resources: [this.logsBucket.arnForObjects(`AWSLogs/${props.account}/*`)],
        conditions: {
          StringEquals: {
            's3:x-amz-acl': 'bucket-owner-full-control',
            'aws:SourceArn': `arn:aws:cloudtrail:${props.region}:${props.account}:trail/${trailName}`,
          },
        },
      }),
    );

    // Create CloudTrail trail
    this.trail = new Trail(this, 'GatewayDataEventTrail', {
      trailName,
      bucket: this.logsBucket,
      isMultiRegionTrail: props.isMultiRegionTrail ?? false,
      includeGlobalServiceEvents: props.includeGlobalServiceEvents ?? true,
      enableFileValidation: true,
    });

    // Add advanced event selectors for Bedrock Agent Core Gateway data events
    const cfnTrail = this.trail.node.defaultChild as CfnTrail;

    // Define the advanced event selectors
    const advancedEventSelectors = [
      {
        // Log Bedrock Agent Core Gateway Data Events only
        fieldSelectors: [
          {
            field: 'eventCategory',
            equalTo: ['Data'],
          },
          {
            field: 'resources.type',
            equalTo: ['AWS::BedrockAgentCore::Gateway'],
          },
        ],
      },
    ];

    // Clear any existing event selectors and set advanced event selectors
    cfnTrail.eventSelectors = undefined;
    cfnTrail.advancedEventSelectors = advancedEventSelectors;
  }
}