本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
# 使用 记录 API 调用 AWS CloudTrail 适合 AWS Organizations
AWS Organizations 与 AWS CloudTrail一项服务集成，该服务提供用户、角色或 AWS 服务在中执行的操作的记录 AWS Organizations。 CloudTrail 将所有 API 调用捕获 AWS Organizations 为事件，包括来自 AWS Organizations 控制台的调用和对 AWS Organizations API 的代码调用。如果您创建跟踪，则可以启用向 Amazon S3 存储桶持续交付事件，包括的事件 AWS Organizations。 CloudTrail 如果您未配置跟踪，仍可以在 CloudTrail 控制台的事件历史记录中查看最新**事件**。使用收集的信息 CloudTrail，您可以确定向谁发出的请求 AWS Organizations、发出的请求的 IP 地址、发出的人、提出请求的时间以及其他详细信息。
要了解更多信息 CloudTrail，请参阅《*AWS CloudTrail 用户指南》*。
**重要**
您 AWS Organizations 只能查看美国东部（弗吉尼亚北部）地区的所有 CloudTrail 信息。如果您在 CloudTrail 主机中看不到自己的 AWS Organizations 活动，请**使用右上角的菜单将您的主机设置为**美国东部（弗吉尼亚北部）。如果您使用 AWS CLI 或 SDK 工具 CloudTrail 进行查询，请将查询定向到美国东部（弗吉尼亚北部）终端节点。
## AWS Organizations 中的信息 CloudTrail
CloudTrail 在您创建帐户 AWS 账户 时已在您的上启用。当活动发生在中时 AWS Organizations，该活动将与 CloudTrail 事件历史记录中的其他 AWS 服务事件一起记录在**事件中**。您可以在中查看、搜索和下载最近的事件 AWS 账户。有关更多信息，请参阅使用事件历史记录[查看 CloudTrail 事件](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html)。
对于 AWS 账户中的事件的持续记录（包括 AWS Organizations的事件），请创建跟踪记录。跟踪可以 CloudTrail 将日志文件传输到 Amazon S3 存储桶。在您的中启用 CloudTrail 日志记录后 AWS 账户，对 AWS Organizations 操作的 API 调用将在 CloudTrail 日志文件中进行跟踪，这些调用将与其他 AWS 服务记录一起写入。您可以 AWS 服务 将其他配置为进一步分析和处理 CloudTrail 日志中收集的事件数据。有关更多信息，请参阅下列内容：
+ [创建跟踪概述](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html)
+ [CloudTrail 支持的服务和集成 ](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-aws-service-specific-topics.html#cloudtrail-aws-service-specific-topics-integrations)
+ [为以下对象配置 Amazon SNS 通知 CloudTrail ](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/getting_notifications_top_level.html)
所有 AWS Organizations 操作均由 API 参考记录 CloudTrail 并记录在 [AWS Organizations API 参考中](https://docs.aws.amazon.com/organizations/latest/APIReference/)。例如，调用`CreateAccount`（包括`CreateAccountResult`事件）`ListHandshakesForAccount``CreatePolicy`、和会在 CloudTrail 日志文件中`InviteAccountToOrganization`生成条目。
每个日志条目都包含有关生成请求的人员的信息。日志条目中的用户身份信息可帮助您确定以下内容：
+ 请求是使用根用户凭证还是 IAM 用户凭证发出的
+ 请求是使用 [IAM 角色](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html)还是[联合身份用户](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers.html)的临时安全凭证发出的
+ 请求是否由其他 AWS 服务提出
有关更多信息，请参阅 [CloudTrail userIdentity 元素](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html)。
**注意**
CloudTrail 将在采取给定操作的账户中记录事件（例如，如果成员账户采取了操作，则记录在成员账户而不是管理账户中）。例如，离开组织的成员账户将登录到成员账户跟踪中，而移除成员账户的管理账户将登录到管理账户追踪中。
## 了解 AWS Organizations 日志文件条目
跟踪是一种配置，它允许将事件作为日志文件传输到您指定的 Amazon S3 存储桶。 CloudTrail 日志文件包含一个或多个日志条目。一个事件表示来自任何源的一个请求，包括有关所请求的操作、操作的日期和时间、请求参数等方面的信息。 CloudTrail 日志文件不是公用 API 调用的有序堆栈跟踪，因此它们不会以任何特定顺序显示。
### 示例日志条目： CloseAccount
以下示例显示了`CloseAccount`调用 API 且关闭账户的工作流程在后台开始处理时生成的示例调用的 CloudTrail 日志条目。
```
{
"eventVersion": "1.08",
"userIdentity": {
"type": "IAMUser",
"principalId": "AIDAMVNPBQA3EXAMPLE:my-admin-role",
"arn": "arn:aws:sts::111122223333:assumed-role/my-admin-role/my-session-id",
"accountId": "111122223333",
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"sessionContext": {
"sessionIssuer": {
"type": "Role",
"principalId": "AIDAMVNPBQA3EXAMPLE",
"arn": "arn:aws:iam::111122223333:role/my-admin-role",
"accountId": "111122223333",
"userName": "my-session-id"
},
"webIdFederationData": {},
"attributes": {
"mfaAuthenticated": "false",
"creationDate": "2022-03-18T18:17:06Z"
}
}
},
"eventTime": "2022-03-18T18:17:06Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "CloseAccount",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.168.0.1",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)...",
"requestParameters": {
"accountId": "555555555555"
},
"responseElements": null,
"requestID": "e28932f8-d5da-4d7a-8238-ef74f3d5c09a",
"eventID": "19fe4c10-f57e-4cb7-a2bc-6b5c30233592",
"readOnly": false,
"eventType": "AwsApiCall",
"managementEvent": true,
"recipientAccountId": "111122223333",
"eventCategory": "Management"
}
```
以下示例显示了关闭账户的后台工作流程成功完成后的`CloseAccountResult`呼叫 CloudTrail 日志条目。
```
{
"eventVersion": "1.08",
"userIdentity": {
"accountId": "111122223333",
"invokedBy": "organizations.amazonaws.com"
},
"eventTime": "2022-03-18T18:17:06Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "CloseAccountResult",
"awsRegion": "us-east-1",
"sourceIPAddress": "organizations.amazonaws.com",
"userAgent": "organizations.amazonaws.com",
"requestParameters": null,
"responseElements": null,
"eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"readOnly": false,
"eventType": "AwsServiceEvent",
"readOnly": false,
"eventType": "AwsServiceEvent",
"managementEvent": true,
"recipientAccountId": "111122223333",
"serviceEventDetails": {
"closeAccountStatus": {
"accountId": "555555555555",
"state": "SUCCEEDED",
"requestedTimestamp": "Mar 18, 2022 6:16:58 PM",
"completedTimestamp": "Mar 18, 2022 6:16:58 PM"
}
},
"eventCategory": "Management"
}
```
### 示例日志条目： CreateAccount
以下示例显示了示例`CreateAccount`调用的 CloudTrail 日志条目，该调用是在调用 API 且创建账户的工作流程在后台开始处理时生成的。
```
{
"eventVersion": "1.05",
"userIdentity": {
"type": "IAMUser",
"principalId": "AIDAMVNPBQA3EXAMPLE:my-admin-role",
"arn": "arn:aws:sts::111122223333:assumed-role/my-admin-role/my-session-id",
"accountId": "111122223333",
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"sessionContext": {
"sessionIssuer": {
"type": "Role",
"principalId": "AIDAMVNPBQA3EXAMPLE",
"arn": "arn:aws:iam::111122223333:role/my-admin-role",
"accountId": "111122223333",
"userName": "my-session-id"
},
"webIdFederationData": {},
"attributes": {
"mfaAuthenticated": "false",
"creationDate": "2020-09-16T21:16:45Z"
}
}
},
"eventTime": "2018-06-21T22:06:27Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "CreateAccount",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.168.0.1",
"userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)...",
"requestParameters": {
"tags": [],
"email": "****",
"accountName": "****"
},
"responseElements": {
"createAccountStatus": {
"accountName": "****",
"state": "IN_PROGRESS",
"id": "car-examplecreateaccountrequestid111",
"requestedTimestamp": "Sep 16, 2020 9:20:50 PM"
}
},
"requestID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"eventType": "AwsApiCall",
"recipientAccountId": "111111111111"
}
```
以下示例显示了创建账户的后台工作流程成功完成后的`CreateAccount`呼叫 CloudTrail 日志条目。
```
{
"eventVersion": "1.05",
"userIdentity": {
"accountId": "111122223333",
"invokedBy": "..."
},
"eventTime": "2020-09-16T21:20:53Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "CreateAccountResult",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "....",
"requestParameters": null,
"responseElements": null,
"eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"readOnly": false,
"eventType": "AwsServiceEvent",
"recipientAccountId": "111122223333",
"serviceEventDetails": {
"createAccountStatus": {
"id": "car-examplecreateaccountrequestid111",
"state": "SUCCEEDED",
"accountName": "****",
"accountId": "444455556666",
"requestedTimestamp": "Sep 16, 2020 9:20:50 PM",
"completedTimestamp": "Sep 16, 2020 9:20:53 PM"
}
}
}
```
以下示例显示了在后`CreateAccount`台工作流程无法创建账户后生成的 CloudTrail 日志条目。
```
{
"eventVersion": "1.06",
"userIdentity": {
"accountId": "111122223333",
"invokedBy": "AWS Internal"
},
"eventTime": "2018-06-21T22:06:27Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "CreateAccountResult",
"awsRegion": "us-east-1",
"sourceIPAddress": "AWS Internal",
"userAgent": "AWS Internal",
"requestParameters": null,
"responseElements": null,
"eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"readOnly": false,
"eventType": "AwsServiceEvent",
"recipientAccountId": "111122223333",
"serviceEventDetails": {
"createAccountStatus": {
"id": "car-examplecreateaccountrequestid111",
"state": "FAILED",
"accountName": "****",
"failureReason": "EMAIL_ALREADY_EXISTS",
"requestedTimestamp": Jun 21, 2018 10:06:27 PM,
"completedTimestamp": Jun 21, 2018 10:07:15 PM
}
}
}
```
### 示例日志条目： AcceptResponsibilityTransfer
当 AWS Organizations 接受账单责任转移时，它会向每个受影响的账户发布`ResponsibilityTransferAccepted`服务事件。对于链式转账， AWS Organizations 还会通知上游参与者。该`transferChain`字段列出了从已接受的传输到受影响最大的上游传输的受影响转移 ID。
以下示例显示了 AWS Organizations 接受下游转移 (rt-5ipg3ess) 后传送到上游分销商账户 (111122223333) 的 CloudTrail 日志条目。该`transferChain`字段包括接受的传输和受影响的上游传输 (rt-9zpzuocg)。
```
{
"eventVersion": "1.11",
"userIdentity": {
"type": "AWSService",
"invokedBy": "AWS Internal"
},
"eventTime": "2026-08-12T19:50:27Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "ResponsibilityTransferAccepted",
"awsRegion": "us-east-1",
"sourceIPAddress": "AWS Internal",
"userAgent": "AWS Internal",
"requestParameters": null,
"responseElements": null,
"eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"readOnly": false,
"eventType": "AwsServiceEvent",
"managementEvent": true,
"recipientAccountId": "111122223333",
"sharedEventID": "EXAMPLEa-121c-425d-bb01-1d94aEXAMPLE",
"serviceEventDetails": {
"id": "rt-5ipg3ess",
"transferChain": [
"rt-5ipg3ess",
"rt-9zpzuocg"
],
"type": "BILLING",
"status": "ACCEPTED",
"source": {
"managementAccountId": "555555555555"
},
"target": {
"managementAccountId": "444455556666"
},
"requester": "555555555555",
"startTimestamp": 1790812800000
},
"eventCategory": "Management"
}
```
### 示例日志条目： TerminateResponsibilityTransfer
账单责任转移结束后，向每个受影响的账户 AWS Organizations 发布`ResponsibilityTransferTerminated`服务事件。对于链式转账，分销商等上游参与者也会收到通知。该`transferChain`字段列出了从已终止的传输到受影响最大的上游传输的受影响转移 ID。
以下示例显示了 AWS Organizations 终止下游传输 (rt-5ipg3ess) 后传送到上游分销商账户 (111122223333) 的 CloudTrail 日志条目。该`transferChain`字段包括终止的传输和受影响的上游传输 (rt-9zpzuocg)。
```
{
"eventVersion": "1.11",
"userIdentity": {
"type": "AWSService",
"invokedBy": "AWS Internal"
},
"eventTime": "2026-08-12T18:17:06Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "ResponsibilityTransferTerminated",
"awsRegion": "us-east-1",
"sourceIPAddress": "AWS Internal",
"userAgent": "AWS Internal",
"requestParameters": null,
"responseElements": null,
"eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"readOnly": false,
"eventType": "AwsServiceEvent",
"managementEvent": true,
"recipientAccountId": "111122223333",
"sharedEventID": "EXAMPLEa-121c-425d-bb01-1d94aEXAMPLE",
"serviceEventDetails": {
"id": "rt-5ipg3ess",
"transferChain": [
"rt-5ipg3ess",
"rt-9zpzuocg"
],
"type": "BILLING",
"status": "WITHDRAWN",
"source": {
"managementAccountId": "444455556666"
},
"target": {
"managementAccountId": "555555555555"
},
"requester": "444455556666",
"startTimestamp": 1790812800000,
"endTimestamp": 1790812800000
},
"eventCategory": "Management"
}
```
### 示例日志条目： CreateOrganizationalUnit
以下示例显示了示例`CreateOrganizationalUnit`呼叫的 CloudTrail 日志条目。
```
{
"eventVersion": "1.05",
"userIdentity": {
"type": "IAMUser",
"principalId": "AIDAMVNPBQA3EXAMPLE",
"arn": "arn:aws:iam::111111111111:user/diego",
"accountId": "111111111111",
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"userName": "diego"
},
"eventTime": "2017-01-18T21:40:11Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "CreateOrganizationalUnit",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.95 Safari/537.36",
"requestParameters": {
"name": "OU-Developers-1",
"parentId": "r-a1b2"
},
"responseElements": {
"organizationalUnit": {
"arn": "arn:aws:organizations::111111111111:ou/o-aa111bb222/ou-examplerootid111-exampleouid111",
"id": "ou-examplerootid111-exampleouid111",
"name": "test-cloud-trail",
"path": "o-aa111bb222/r-a1b2/ou-examplerootid111-exampleouid111/"
}
},
"requestID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"eventType": "AwsApiCall",
"recipientAccountId": "111111111111"
}
```
### 示例日志条目： InviteAccountToOrganization
以下示例显示了示例`InviteAccountToOrganization`呼叫的 CloudTrail 日志条目。
```
{
"eventVersion": "1.05",
"userIdentity": {
"type": "IAMUser",
"principalId": "AIDAMVNPBQA3EXAMPLE",
"arn": "arn:aws:iam::111111111111:user/diego",
"accountId": "111111111111",
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"userName": "diego"
},
"eventTime": "2017-01-18T21:41:17Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "InviteAccountToOrganization",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.95 Safari/537.36",
"requestParameters": {
"notes": "This is a request for Mary's account to join Diego's organization.",
"target": {
"type": "ACCOUNT",
"id": "111111111111"
}
},
"responseElements": {
"handshake": {
"requestedTimestamp": "Jan 18, 2017 9:41:16 PM",
"state": "OPEN",
"arn": "arn:aws:organizations::111111111111:handshake/o-aa111bb222/invite/h-examplehandshakeid111",
"id": "h-examplehandshakeid111",
"parties": [
{
"type": "ORGANIZATION",
"id": "o-aa111bb222"
},
{
"type": "ACCOUNT",
"id": "222222222222"
}
],
"action": "invite",
"expirationTimestamp": "Feb 2, 2017 9:41:16 PM",
"resources": [
{
"resources": [
{
"type": "MASTER_EMAIL",
"value": "diego@example.com"
},
{
"type": "MASTER_NAME",
"value": "Management account for organization"
},
{
"type": "ORGANIZATION_FEATURE_SET",
"value": "ALL"
}
],
"type": "ORGANIZATION",
"value": "o-aa111bb222"
},
{
"type": "ACCOUNT",
"value": "222222222222"
},
{
"type": "NOTES",
"value": "This is a request for Mary's account to join Diego's organization."
}
]
}
},
"requestID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"eventType": "AwsApiCall",
"recipientAccountId": "111111111111"
}
```
### 示例日志条目： AttachPolicy
以下示例显示了示例`AttachPolicy`呼叫的 CloudTrail 日志条目。该响应指示，在请求尝试附加到的根中，由于请求的策略类型未启用，调用失败。
```
{
"eventVersion": "1.06",
"userIdentity": {
"type": "IAMUser",
"principalId": "AIDAMVNPBQA3EXAMPLE",
"arn": "arn:aws:iam::111111111111:user/diego",
"accountId": "111111111111",
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"userName": "diego"
},
"eventTime": "2017-01-18T21:42:44Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "AttachPolicy",
"awsRegion": "us-east-1",
"sourceIPAddress": "192.0.2.0",
"userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.95 Safari/537.36",
"errorCode": "PolicyTypeNotEnabledException",
"errorMessage": "The given policy type ServiceControlPolicy is not enabled on the current view",
"requestParameters": {
"policyId": "p-examplepolicyid111",
"targetId": "ou-examplerootid111-exampleouid111"
},
"responseElements": null,
"requestID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"eventType": "AwsApiCall",
"recipientAccountId": "111111111111"
}
```
### 示例日志条目：无效的有效策略
以下示例显示了示例`EffectivePolicyValidation`事件的 CloudTrail 日志条目。每当组织中的更新导致任何账户创建了无效的有效政策时，就会向组织的管理账户发送此事件。
```
{
"eventVersion": "1.11",
"userIdentity": {
"accountId": "111122223333",
"invokedBy": "AWS Internal"
},
"eventTime": "2025-07-17T14:53:40Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "EffectivePolicyValidation",
"awsRegion": "us-east-1",
"sourceIPAddress": "AWS Internal",
"userAgent": "AWS Internal",
"requestParameters": null,
"responseElements": null,
"eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"readOnly": true,
"eventType": "AwsServiceEvent",
"managementEvent": true,
"recipientAccountId": "111111111111",
"serviceEventDetails": {
"accountId": "111111111111",
"policyType": "BACKUP_POLICY",
"state": "INVALID",
"requestTimestamp": "Jul 17, 2025, 2:53:40 PM",
"info": "All validation errors listed",
"validationErrors": [
{
"accountPath": "o-aa111bb222/r-a1b2/111111111111/",
"evaluationTimestamp": "Jul 17, 2025, 2:53:40 PM",
"errorCode": "ELEMENTS_TOO_MANY",
"errorMessage": "'hourly_rule' exceeds the allowed maximum limit 10",
"pathToError": "plans/hourly-backup/rules/hourly_rule",
"contributingPolicies": [
"p-examplepolicyid111"
]
}
]
},
"eventCategory": "Management"
}
```
### 示例日志条目：有效的有效策略
以下示例显示了示例`EffectivePolicyValidation`事件的 CloudTrail 日志条目。每当组织中的更新修复了账户中之前无效的有效策略时，就会向组织的管理账户发送此事件。
```
{
"eventVersion": "1.11",
"userIdentity": {
"accountId": "111111111111",
"invokedBy": "AWS Internal"
},
"eventTime": "2025-07-17T14:54:40Z",
"eventSource": "organizations.amazonaws.com",
"eventName": "EffectivePolicyValidation",
"awsRegion": "us-east-1",
"sourceIPAddress": "AWS Internal",
"userAgent": "AWS Internal",
"requestParameters": null,
"responseElements": null,
"eventID": "EXAMPLE8-90ab-cdef-fedc-ba987EXAMPLE",
"readOnly": true,
"eventType": "AwsServiceEvent",
"managementEvent": true,
"recipientAccountId": "111111111111",
"serviceEventDetails": {
"accountId": "111111111111",
"policyType": "BACKUP_POLICY",
"state": "VALID",
"requestTimestamp": "Jul 17, 2025, 2:54:40 PM",
"info": "Previous effective policy validation error(s) resolved for this account/policyType"
},
"eventCategory": "Management"
}
```