View a markdown version of this page

啟用 Amazon Bedrock AgentCore Gateway 資源的 CloudTrail 資料事件記錄 - Amazon Bedrock AgentCore

啟用 Amazon Bedrock AgentCore Gateway 資源的 CloudTrail 資料事件記錄

您可以使用 CloudTrail 資料事件來取得 Amazon Bedrock AgentCore Gateway 請求的相關資訊。若要啟用閘道的 CloudTrail 資料事件，您必須在由 Amazon S3 儲存貯體支援的 CloudTrail 中手動建立追蹤。

重要考量事項

  • 資料事件記錄會產生額外費用。您必須明確啟用資料事件，因為預設不會擷取它們。檢查 以確保您的帳戶已啟用資料事件。

  • 透過產生高工作負載的閘道，您可以在短時間內快速產生數千個日誌。請注意，您選擇為忙碌的閘道啟用 CloudTrail 資料事件的時間長度。

  • CloudTrail 會將閘道資料事件日誌存放在您選擇的 Amazon S3 儲存貯體中。考慮在個別 AWS 帳戶中使用儲存貯體，將多個資源的事件更妥善地組織到集中位置，以便於查詢和分析。

當您在 CloudTrail 中記錄線索的資料事件時，您必須使用進階事件選取器來記錄閘道操作的資料事件。

範例
AWS CLI

  1. 若要使用 CLI AWS 為閘道資源啟用 CloudTrail 資料事件，您可以在終端機中執行下列命令：

    aws cloudtrail put-event-selectors \
  --trail-name brac-gateway-canary-trail-prod-us-east-1 \
  --region us-east-1 \
  --advanced-event-selectors '[
    {
      "Name": "GatewayDataEvents",
      "FieldSelectors": [
        {
          "Field": "eventCategory",
          "Equals": ["Data"]
        },
        {
          "Field": "resources.type",
          "Equals": ["AWS::BedrockAgentCore::Gateway"]
        }
      ]
    }
  ]'
AWS CDK

  1. 下列範例示範如何使用 AWS CDK 使用 AgentCore Gateway 資料事件建立 CloudTrail 追蹤：

    import { Construct } from 'constructs';
import { Trail, CfnTrail } from 'aws-cdk-lib/aws-cloudtrail';
import { Bucket } from 'aws-cdk-lib/aws-s3';
import { Effect, PolicyStatement, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
import { RemovalPolicy } from 'aws-cdk-lib';

export interface DataEventTrailProps {
  /**
   * Whether to enable multi-region trail
   */
  isMultiRegionTrail?: boolean;

  /**
   * Whether to include global service events
   */
  includeGlobalServiceEvents?: boolean;

  /**
   * AWS region
   */
  region: string;

  /**
   * Environment account ID
   */
  account: string;
}

/**
 * Creates a CloudTrail trail configured to capture data events for Bedrock Agent Core Gateway
 */
export class BedrockAgentCoreDataEventTrail extends Construct {
  /**
   * The CloudTrail trail
   */
  public readonly trail: Trail;

  /**
   * The S3 bucket for CloudTrail logs
   */
  public readonly logsBucket: Bucket;

  constructor(scope: Construct, id: string, props: DataEventTrailProps) {
    super(scope, id);

    // Create S3 bucket for CloudTrail logs
    const bucketName = `brac-gateway-cloudtrail-logs-${props.account}-${props.region}`;
    this.logsBucket = new Bucket(this, 'CloudTrailLogsBucket', {
      bucketName,
      removalPolicy: RemovalPolicy.RETAIN,
    });

    // Create trail name (suffixing region since regional trail)
    const trailName = `brac-gateway-trail-${props.region}`;

    // Add CloudTrail bucket policy
    this.logsBucket.addToResourcePolicy(
      new PolicyStatement({
        sid: 'AWSCloudTrailAclCheck',
        effect: Effect.ALLOW,
        principals: [new ServicePrincipal('cloudtrail.amazonaws.com')],
        actions: ['s3:GetBucketAcl'],
        resources: [this.logsBucket.bucketArn],
        conditions: {
          StringEquals: {
            'aws:SourceArn': `arn:aws:cloudtrail:${props.region}:${props.account}:trail/${trailName}`,
          },
        },
      }),
    );

    this.logsBucket.addToResourcePolicy(
      new PolicyStatement({
        sid: 'AWSCloudTrailWrite',
        effect: Effect.ALLOW,
        principals: [new ServicePrincipal('cloudtrail.amazonaws.com')],
        actions: ['s3:PutObject'],
        resources: [this.logsBucket.arnForObjects(`AWSLogs/${props.account}/*`)],
        conditions: {
          StringEquals: {
            's3:x-amz-acl': 'bucket-owner-full-control',
            'aws:SourceArn': `arn:aws:cloudtrail:${props.region}:${props.account}:trail/${trailName}`,
          },
        },
      }),
    );

    // Create CloudTrail trail
    this.trail = new Trail(this, 'GatewayDataEventTrail', {
      trailName,
      bucket: this.logsBucket,
      isMultiRegionTrail: props.isMultiRegionTrail ?? false,
      includeGlobalServiceEvents: props.includeGlobalServiceEvents ?? true,
      enableFileValidation: true,
    });

    // Add advanced event selectors for Bedrock Agent Core Gateway data events
    const cfnTrail = this.trail.node.defaultChild as CfnTrail;

    // Define the advanced event selectors
    const advancedEventSelectors = [
      {
        // Log Bedrock Agent Core Gateway Data Events only
        fieldSelectors: [
          {
            field: 'eventCategory',
            equalTo: ['Data'],
          },
          {
            field: 'resources.type',
            equalTo: ['AWS::BedrockAgentCore::Gateway'],
          },
        ],
      },
    ];

    // Clear any existing event selectors and set advanced event selectors
    cfnTrail.eventSelectors = undefined;
    cfnTrail.advancedEventSelectors = advancedEventSelectors;
  }
}