Log API Calls for EBS direct APIs with AWS CloudTrail - Amazon EBS

Log API Calls for EBS direct APIs with AWS CloudTrail

The EBS direct APIs service is integrated with AWS CloudTrail. CloudTrail is a service that provides a record of actions taken by a user, role, or an AWS service. CloudTrail captures all API calls performed in EBS direct APIs as events. If you create a trail, you can enable continuous delivery of CloudTrail events to an Amazon Simple Storage Service (Amazon S3) bucket. If you don't configure a trail, you can still view the most recent management events in the CloudTrail console in Event history. Data events are not captured in Event history. You can use the information collected by CloudTrail to determine the request that was made to EBS direct APIs, the IP address from which the request was made, who made the request, when it was made, and additional details.

For more information about CloudTrail, see the AWS CloudTrail User Guide.

EBS direct APIs Information in CloudTrail

CloudTrail is enabled on your AWS account when you create the account. When supported event activity occurs in EBS direct APIs, that activity is recorded in a CloudTrail event along with other AWS service events in Event history. You can view, search, and download recent events in your AWS account. For more information, see Viewing Events with CloudTrail Event History.

For an ongoing record of events in your AWS account, including events for EBS direct APIs, create a trail. A trail enables CloudTrail to deliver log files to an S3 bucket. By default, when you create a trail in the console, the trail applies to all AWS Regions. The trail logs events from all Regions in the AWS partition and delivers the log files to the S3 bucket that you specify. Additionally, you can configure other AWS services to further analyze and act upon the event data collected in CloudTrail logs. For more information, see the following:

Supported API actions

For EBS direct APIs, you can use CloudTrail to log two types of events:

  • Management events — Management events provide visibility into management operations that are performed on snapshots in your AWS account. The following API actions are logged by default as management events in trails:

    For more information about logging management events, see Logging management events for trails in the CloudTrail User Guide.

  • Data events — These events provide visibility into the snapshot operations performed on or within a snapshot. The following API actions can optionally be logged as data events in trails:

    Data events are not logged by default when you create a trail. You can use only advanced event selectors to record data events on EBS direct API calls. For more information, see Logging data events for trails in the CloudTrail User Guide.


    If you perform an action on a snapshot that is shared with you, data events are not sent to the AWS account that owns the snapshot.

Identity information

Every event or log entry contains information about who generated the request. The identity information helps you determine the following:

  • Whether the request was made with root user or user credentials.

  • Whether the request was made with temporary security credentials for a role or federated user.

  • Whether the request was made by another AWS service.

For more information, see the CloudTrail userIdentityElement.

Understand EBS direct APIs Log File Entries

A trail is a configuration that enables delivery of events as log files to an S3 bucket that you specify. CloudTrail log files contain one or more log entries. An event represents a single request from any source and includes information about the requested action, the date and time of the action, request parameters, and so on. CloudTrail log files aren't an ordered stack trace of the public API calls, so they don't appear in any specific order.

The following are example CloudTrail log entries.

{ "eventVersion": "1.05", "userIdentity": { "type": "IAMUser", "principalId": "123456789012", "arn": "arn:aws:iam::123456789012:root", "accountId": "123456789012", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName": "user" }, "eventTime": "2020-07-03T23:27:26Z", "eventSource": "ebs.amazonaws.com", "eventName": "StartSnapshot", "awsRegion": "eu-west-1", "sourceIPAddress": "", "userAgent": "PostmanRuntime/7.25.0", "requestParameters": { "volumeSize": 8, "clientToken": "token", "encrypted": true }, "responseElements": { "snapshotId": "snap-123456789012", "ownerId": "123456789012", "status": "pending", "startTime": "Jul 3, 2020 11:27:26 PM", "volumeSize": 8, "blockSize": 524288, "kmsKeyArn": "HIDDEN_DUE_TO_SECURITY_REASONS" }, "requestID": "be112233-1ba5-4ae0-8e2b-1c302EXAMPLE", "eventID": "6e12345-2a4e-417c-aa78-7594fEXAMPLE", "eventType": "AwsApiCall", "recipientAccountId": "123456789012" }
{ "eventVersion": "1.05", "userIdentity": { "type": "IAMUser", "principalId": "123456789012", "arn": "arn:aws:iam::123456789012:root", "accountId": "123456789012", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName": "user" }, "eventTime": "2020-07-03T23:28:24Z", "eventSource": "ebs.amazonaws.com", "eventName": "CompleteSnapshot", "awsRegion": "eu-west-1", "sourceIPAddress": "", "userAgent": "PostmanRuntime/7.25.0", "requestParameters": { "snapshotId": "snap-123456789012", "changedBlocksCount": 5 }, "responseElements": { "status": "completed" }, "requestID": "be112233-1ba5-4ae0-8e2b-1c302EXAMPLE", "eventID": "6e12345-2a4e-417c-aa78-7594fEXAMPLE", "eventType": "AwsApiCall", "recipientAccountId": "123456789012" }
{ "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "AIDAT4HPB2AO3JEXAMPLE", "arn": "arn:aws:iam::123456789012:user/user", "accountId": "123456789012", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName": "user" }, "eventTime": "2021-06-03T00:32:46Z", "eventSource": "ebs.amazonaws.com", "eventName": "ListSnapshotBlocks", "awsRegion": "us-east-1", "sourceIPAddress": "", "userAgent": "PostmanRuntime/7.28.0", "requestParameters": { "snapshotId": "snap-abcdef01234567890", "maxResults": 100, "startingBlockIndex": 0 }, "responseElements": null, "requestID": "example6-0e12-4aa9-b923-1555eexample", "eventID": "example4-218b-4f69-a9e0-2357dexample", "readOnly": true, "resources": [ { "accountId": "123456789012", "type": "AWS::EC2::Snapshot", "ARN": "arn:aws:ec2:us-west-2::snapshot/snap-abcdef01234567890" } ], "eventType": "AwsApiCall", "managementEvent": false, "recipientAccountId": "123456789012", "eventCategory": "Data", "tlsDetails": { "tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-SHA", "clientProvidedHostHeader": "ebs.us-west-2.amazonaws.com" } }
{ "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "AIDAT4HPB2AO3JEXAMPLE", "arn": "arn:aws:iam::123456789012:user/user", "accountId": "123456789012", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName": "user" }, "eventTime": "2021-06-02T21:11:46Z", "eventSource": "ebs.amazonaws.com", "eventName": "ListChangedBlocks", "awsRegion": "us-east-1", "sourceIPAddress": "", "userAgent": "PostmanRuntime/7.28.0", "requestParameters": { "firstSnapshotId": "snap-abcdef01234567890", "secondSnapshotId": "snap-9876543210abcdef0", "maxResults": 100, "startingBlockIndex": 0 }, "responseElements": null, "requestID": "example0-f4cb-4d64-8d84-72e1bexample", "eventID": "example3-fac4-4a78-8ebb-3e9d3example", "readOnly": true, "resources": [ { "accountId": "123456789012", "type": "AWS::EC2::Snapshot", "ARN": "arn:aws:ec2:us-west-2::snapshot/snap-abcdef01234567890" }, { "accountId": "123456789012", "type": "AWS::EC2::Snapshot", "ARN": "arn:aws:ec2:us-west-2::snapshot/snap-9876543210abcdef0" } ], "eventType": "AwsApiCall", "managementEvent": false, "recipientAccountId": "123456789012", "eventCategory": "Data", "tlsDetails": { "tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-SHA", "clientProvidedHostHeader": "ebs.us-west-2.amazonaws.com" } }
{ "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "AIDAT4HPB2AO3JEXAMPLE", "arn": "arn:aws:iam::123456789012:user/user", "accountId": "123456789012", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName": "user" }, "eventTime": "2021-06-02T20:43:05Z", "eventSource": "ebs.amazonaws.com", "eventName": "GetSnapshotBlock", "awsRegion": "us-east-1", "sourceIPAddress": "", "userAgent": "PostmanRuntime/7.28.0", "requestParameters": { "snapshotId": "snap-abcdef01234567890", "blockIndex": 1, "blockToken": "EXAMPLEiL5E3pMPFpaDWjExM2/mnSKh1mQfcbjwe2mM7EwhrgCdPAEXAMPLE" }, "responseElements": null, "requestID": "examplea-6eca-4964-abfd-fd9f0example", "eventID": "example6-4048-4365-a275-42e94example", "readOnly": true, "resources": [ { "accountId": "123456789012", "type": "AWS::EC2::Snapshot", "ARN": "arn:aws:ec2:us-west-2::snapshot/snap-abcdef01234567890" } ], "eventType": "AwsApiCall", "managementEvent": false, "recipientAccountId": "123456789012", "eventCategory": "Data", "tlsDetails": { "tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-SHA", "clientProvidedHostHeader": "ebs.us-west-2.amazonaws.com" } }
{ "eventVersion": "1.08", "userIdentity": { "type": "IAMUser", "principalId": "AIDAT4HPB2AO3JEXAMPLE", "arn": "arn:aws:iam::123456789012:user/user", "accountId": "123456789012", "accessKeyId": "AKIAIOSFODNN7EXAMPLE", "userName": "user" }, "eventTime": "2021-06-02T21:09:17Z", "eventSource": "ebs.amazonaws.com", "eventName": "PutSnapshotBlock", "awsRegion": "us-east-1", "sourceIPAddress": "", "userAgent": "PostmanRuntime/7.28.0", "requestParameters": { "snapshotId": "snap-abcdef01234567890", "blockIndex": 1, "dataLength": 524288, "checksum": "exampleodSGvFSb1e3kxWUgbOQ4TbzPurnsfVexample", "checksumAlgorithm": "SHA256" }, "responseElements": { "checksum": "exampleodSGvFSb1e3kxWUgbOQ4TbzPurnsfVexample", "checksumAlgorithm": "SHA256" }, "requestID": "example3-d5e0-4167-8ee8-50845example", "eventID": "example8-4d9a-4aad-b71d-bb31fexample", "readOnly": false, "resources": [ { "accountId": "123456789012", "type": "AWS::EC2::Snapshot", "ARN": "arn:aws:ec2:us-west-2::snapshot/snap-abcdef01234567890" } ], "eventType": "AwsApiCall", "managementEvent": false, "recipientAccountId": "123456789012", "eventCategory": "Data", "tlsDetails": { "tlsVersion": "TLSv1.2", "cipherSuite": "ECDHE-RSA-AES128-SHA", "clientProvidedHostHeader": "ebs.us-west-2.amazonaws.com" } }