監控 Amazon EBS 快照鎖定 - Amazon EBS
使用 CloudTrail 監控使用 EventBridge 監控

本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

監控 Amazon EBS 快照鎖定

您可以使用下列工具監控與 Amazon EBS 快照鎖定相關的動作：

使用 監控 Amazon EBS 快照鎖定 AWS CloudTrail

您可以監控快照鎖定的 API 呼叫作為事件，包括來自主控台的呼叫，以及來自對 APIs 的程式碼呼叫。使用由 CloudTrail 收集的資訊，您可以判斷提出的請求、提出請求的 IP 地址、提出請求的對象、提出的時間，以及其他詳細資訊。

如需詳細資訊，請參閱使用 記錄 API 呼叫 AWS CloudTrail。

使用 AmazonEBS 監控 Amazon EventBridge 快照鎖定

Amazon EBS 會發出與快照鎖定動作相關的事件。您可以使用 AWS Lambda 和 Amazon EventBridge 以程式設計方式處理事件通知。盡可能發出事件。如需詳細資訊，請參閱 Amazon EventBridge 使用者指南。

系統會發出下列事件：

  • 以控管或合規模式成功鎖定快照。

    {
  "version": "0", 
  "id": "01234567-01234-0123-0123-012345678901", 
  "detail-type": "EBS Snapshot Notification", 
  "source": "aws.ec2", 
  "account": "012345678901", 
  "time": "yyyy-mm-ddThh:mm:ssZ", 
  "region": "us-east-1", 
  "resources": [
    "arn:aws:ec2::us-west-2:snapshot/snap-01234567890abcdef" 
  ], 
  "detail": {
    "event": "lockSnapshot", 
    "result": "succeeded", 
    "snapshot_id": "arn:aws:ec2::us-west-2:snapshot/snap-01234567890abcdef", 
    "source": 012345678901, 
    "lockState": "compliance-cooloff", 
    "lockCreatedOn": "yyyy-mm-ddThh:mm:ssZ", 
    "lockExpiresOn": "yyyy-mm-ddThh:mm:ssZ",
    "lockDuration": 123, 
    "lockStartDurationTime": "yyyy-mm-ddThh:mm:ssZ", 
    "cooOffPeriod": 24, 
    "coolOffPeriodExpiresOn": "yyyy-mm-ddThh:mm:ssZ"
  } 
}

  • 快照處於 pending 狀態時被鎖定而且無法達到 completed 狀態，鎖定事件失敗。

    {
  "version": "0", 
  "id": "01234567-01234-0123-0123-012345678901", 
  "detail-type": "EBS Snapshot Notification", 
  "source": "aws.ec2", 
  "account": "012345678901", 
  "time": "yyyy-mm-ddThh:mm:ssZ", 
  "region": "us-east-1", 
  "resources": [
    "arn:aws:ec2::us-west-2:snapshot/snap-01234567890abcdef"
  ], 
  "detail": {
    "event": "lockSnapshot", 
    "result": "failed", 
    "cause": "snapshot failed", 
    "snapshot_id": "arn:aws:ec2::us-west-2:snapshot/snap-01234567890abcdef", 
    "lockState": "pending-compliance", 
    "lockCreatedOn": "yyyy-mm-ddThh:mm:ssZ",
    "lockDuration": 123, 
    "lockStartDurationTime": "yyyy-mm-ddThh:mm:ssZ", 
    "cooOffPeriod": 24, 
    "coolOffPeriodExpiresOn": "yyyy-mm-ddThh:mm:ssZ" 
  }
}

  • 鎖定過期

    {
  "version": "0", 
  "id": "01234567-01234-0123-0123-012345678901", 
  "detail-type": "EBS Snapshot Notification", 
  "source": "aws.ec2", 
  "account": "012345678901", 
  "time": "yyyy-mm-ddThh:mm:ssZ", 
  "region": "us-east-1", 
  "resources": [
    "arn:aws:ec2::us-west-2:snapshot/snap-01234567890abcdef"
  ], 
  "detail": {
    "event": "lockDurationExpiry", 
    "result": "succeeded", 
    "snapshot_id": "arn:aws:ec2::us-west-2:snapshot/snap-01234567890abcdef", 
    "lockState": "expired", 
    "lockCreatedOn": "yyyy-mm-ddThh:mm:ssZ", 
    "lockExpiresOn": "yyyy-mm-ddThh:mm:ssZ", 
    "lockDuration": 123
  }
}

  • 以合規模式鎖定後冷靜期已到期。

    {
  "version": "0", 
  "id": "01234567-01234-0123-0123-012345678901", 
  "detail-type": "EBS Snapshot Notification", 
  "source": "aws.ec2", 
  "account": "012345678901", 
  "time": "yyyy-mm-ddThh:mm:ssZ", 
  "region": "us-east-1", 
  "resources": [ 
    "arn:aws:ec2::us-west-2:snapshot/snap-01234567890abcdef" 
  ], 
  "detail": {
    "event": "cooloffperiodExpiry", 
    "result": "succeeded", 
    "snapshot_id": "arn:aws:ec2::us-west-2:snapshot/snap-01234567890abcdef", 
    "lockState": "compliance", 
    "lockCreatedOn": "yyyy-mm-ddThh:mm:ssZ", 
    "lockExpiresOn": "yyyy-mm-ddThh:mm:ssZ",
    "lockDuration": 123, 
    "lockStartDurationTime": "yyyy-mm-ddThh:mm:ssZ", 
    "cooOffPeriod": 24, 
    "coolOffPeriodExpiresOn": "yyyy-mm-ddThh:mm:ssZ"
  }
}