Terjemahan disediakan oleh mesin penerjemah. Jika konten terjemahan yang diberikan bertentangan dengan versi bahasa Inggris aslinya, utamakan versi bahasa Inggris.
Contoh Pemberitahuan Perubahan Item Konfigurasi
AWS Config menggunakan Amazon SNS untuk mengirimkan pemberitahuan ke titik akhir berlangganan. Pemberitahuan ini memberikan status pengiriman untuk snapshot konfigurasi dan riwayat konfigurasi, dan pemberitahuan tersebut menyediakan setiap item konfigurasi yang AWS Config dibuat saat konfigurasi sumber daya yang direkam AWS berubah. AWS Config juga mengirimkan pemberitahuan yang menunjukkan apakah sumber daya Anda sesuai dengan aturan Anda. Jika Anda memilih untuk memiliki pemberitahuan yang dikirim melalui email, Anda dapat menggunakan filter dalam aplikasi klien email Anda berdasarkan baris subjek dan badan pesan email.
Berikut ini adalah contoh payload notifikasi Amazon SNS yang dihasilkan AWS Config
saat mendeteksi bahwa vol-ce676ccc volume Amazon Elastic Block Store dilampirkan ke instance dengan ID sebesar. i-344c463d Pemberitahuan berisi perubahan item konfigurasi untuk sumber daya.
{ "Type": "Notification", "MessageId": "8b945cb0-db34-5b72-b032-1724878af488", "TopicArn": "arn:aws:sns:us-west-2:123456789012:example", "Message": { "MessageVersion": "1.0", "NotificationCreateTime": "2014-03-18T10:11:00Z", "messageType": "ConfigurationItemChangeNotification", "configurationItem": [ { "configurationItemVersion": "1.0", "configurationItemCaptureTime": "2014-03-07T23:47:08.918Z", "arn": "arn:aws:us-west-2b:123456789012:volume/vol-ce676ccc", "resourceId": "vol-ce676ccc", "accountId": "123456789012", "configurationStateID": "3e660fdf-4e34-4f32-afeb-0ace5bf3d63a", "configurationItemStatus": "OK", "relatedEvents": [], "availabilityZone": "us-west-2b", "resourceType": "AWS::EC2::VOLUME", "resourceCreationTime": "2014-02-27T21:43:53.885Z", "tags": {}, "relationships": [ { "resourceId": "i-344c463d", "resourceType": "AWS::EC2::INSTANCE", "name": "Attached to Instance" } ], "configuration": { "volumeId": "vol-ce676ccc", "size": 1, "snapshotId": "", "availabilityZone": "us-west-2b", "state": "in-use", "createTime": "2014-02-27T21:43:53.0885+0000", "attachments": [ { "volumeId": "vol-ce676ccc", "instanceId": "i-344c463d", "device": "/dev/sdf", "state": "attached", "attachTime": "2014-03-07T23:46:28.0000+0000", "deleteOnTermination": false } ], "tags": [], "volumeType": "standard" } } ], "configurationItemDiff": { "changeType": "UPDATE", "changedProperties": { "Configuration.State": { "previousValue": "available", "updatedValue": "in-use", "changeType": "UPDATE" }, "Configuration.Attachments.0": { "updatedValue": { "VolumeId": "vol-ce676ccc", "InstanceId": "i-344c463d", "Device": "/dev/sdf", "State": "attached", "AttachTime": "FriMar0723: 46: 28UTC2014", "DeleteOnTermination": "false" }, "changeType": "CREATE" } } } }, "Timestamp": "2014-03-07T23:47:10.001Z", "SignatureVersion": "1", "Signature": "LgfJNB5aOk/w3omqsYrv5cUFY8yvIJvO5ZZh46/KGPApk6HXRTBRlkhjacnxIXJEWsGI9mxvMmoWPLJGYEAR5FF/+/Ro9QTmiTNcEjQ5kB8wGsRWVrk/whAzT2lVtofc365En2T1Ncd9iSFFXfJchgBmI7EACZ28t+n2mWFgo57n6eGDvHTedslzC6KxkfWTfXsR6zHXzkB3XuZImktflg3iPKtvBb3Zc9iVbNsBEI4FITFWktSqqomYDjc5h0kgapIo4CtCHGKpALW9JDmP+qZhMzEbHWpzFlEzvFl55KaZXxDbznBD1ZkqPgno/WufuxszCiMrsmV8pUNUnkU1TA==", "SigningCertURL": "https://sns.us-west-2.amazonaws.com/SimpleNotificationService-e372f8ca30337fdb084e8ac449342c77.pem", "UnsubscribeURL": "https://sns.us-west-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-west-2:123456789012:example:a6859fee-3638-407c-907e-879651c9d143" }
Item Konfigurasi untuk Sumber Daya dengan Hubungan
Jika sumber daya terkait dengan sumber daya lain, perubahan pada sumber daya tersebut dapat menghasilkan beberapa item konfigurasi. Contoh berikut menunjukkan cara AWS Config membuat item konfigurasi untuk sumber daya dengan hubungan.
-
Anda memiliki instans Amazon EC2 dengan ID
i-007d374c8912e3e90, dan instans dikaitkan dengan grup keamanan Amazon EC2,.sg-c8b141b4 -
Anda memperbarui instans EC2 Anda untuk mengubah grup keamanan ke grup keamanan lain.
sg-3f1fef43 -
Karena instans EC2 terkait dengan sumber daya lain, AWS Config membuat beberapa item konfigurasi seperti contoh berikut:
Pemberitahuan ini berisi perubahan item konfigurasi untuk instans EC2 saat grup keamanan diganti.
{ "Type": "Notification", "MessageId": "faeba85e-ef46-570a-b01c-f8b0faae8d5d", "TopicArn": "arn:aws:sns:us-east-2:123456789012:config-topic-ohio", "Subject": "[AWS Config:us-east-2] AWS::EC2::Instance i-007d374c8912e3e90 Updated in Account 123456789012", "Message": { "configurationItemDiff": { "changedProperties": { "Configuration.NetworkInterfaces.0": { "previousValue": { "networkInterfaceId": "eni-fde9493f", "subnetId": "subnet-2372be7b", "vpcId": "vpc-14400670", "description": "", "ownerId": "123456789012", "status": "in-use", "macAddress": "0e:36:a2:2d:c5:e0", "privateIpAddress": "172.31.16.84", "privateDnsName": "ip-172-31-16-84.ec2.internal", "sourceDestCheck": true, "groups": [{ "groupName": "example-security-group-1", "groupId": "sg-c8b141b4" }], "attachment": { "attachmentId": "eni-attach-85bd89d9", "deviceIndex": 0, "status": "attached", "attachTime": "2017-01-09T19:36:02.000Z", "deleteOnTermination": true }, "association": { "publicIp": "54.175.43.43", "publicDnsName": "ec2-54-175-43-43.compute-1.amazonaws.com", "ipOwnerId": "amazon" }, "privateIpAddresses": [{ "privateIpAddress": "172.31.16.84", "privateDnsName": "ip-172-31-16-84.ec2.internal", "primary": true, "association": { "publicIp": "54.175.43.43", "publicDnsName": "ec2-54-175-43-43.compute-1.amazonaws.com", "ipOwnerId": "amazon" } }] }, "updatedValue": null, "changeType": "DELETE" }, "Relationships.0": { "previousValue": { "resourceId": "sg-c8b141b4", "resourceName": null, "resourceType": "AWS::EC2::SecurityGroup", "name": "Is associated with SecurityGroup" }, "updatedValue": null, "changeType": "DELETE" }, "Configuration.NetworkInterfaces.1": { "previousValue": null, "updatedValue": { "networkInterfaceId": "eni-fde9493f", "subnetId": "subnet-2372be7b", "vpcId": "vpc-14400670", "description": "", "ownerId": "123456789012", "status": "in-use", "macAddress": "0e:36:a2:2d:c5:e0", "privateIpAddress": "172.31.16.84", "privateDnsName": "ip-172-31-16-84.ec2.internal", "sourceDestCheck": true, "groups": [{ "groupName": "example-security-group-2", "groupId": "sg-3f1fef43" }], "attachment": { "attachmentId": "eni-attach-85bd89d9", "deviceIndex": 0, "status": "attached", "attachTime": "2017-01-09T19:36:02.000Z", "deleteOnTermination": true }, "association": { "publicIp": "54.175.43.43", "publicDnsName": "ec2-54-175-43-43.compute-1.amazonaws.com", "ipOwnerId": "amazon" }, "privateIpAddresses": [{ "privateIpAddress": "172.31.16.84", "privateDnsName": "ip-172-31-16-84.ec2.internal", "primary": true, "association": { "publicIp": "54.175.43.43", "publicDnsName": "ec2-54-175-43-43.compute-1.amazonaws.com", "ipOwnerId": "amazon" } }] }, "changeType": "CREATE" }, "Relationships.1": { "previousValue": null, "updatedValue": { "resourceId": "sg-3f1fef43", "resourceName": null, "resourceType": "AWS::EC2::SecurityGroup", "name": "Is associated with SecurityGroup" }, "changeType": "CREATE" }, "Configuration.SecurityGroups.1": { "previousValue": null, "updatedValue": { "groupName": "example-security-group-2", "groupId": "sg-3f1fef43" }, "changeType": "CREATE" }, "Configuration.SecurityGroups.0": { "previousValue": { "groupName": "example-security-group-1", "groupId": "sg-c8b141b4" }, "updatedValue": null, "changeType": "DELETE" } }, "changeType": "UPDATE" }, "configurationItem": { "relatedEvents": [], "relationships": [ { "resourceId": "eni-fde9493f", "resourceName": null, "resourceType": "AWS::EC2::NetworkInterface", "name": "Contains NetworkInterface" }, { "resourceId": "sg-3f1fef43", "resourceName": null, "resourceType": "AWS::EC2::SecurityGroup", "name": "Is associated with SecurityGroup" }, { "resourceId": "subnet-2372be7b", "resourceName": null, "resourceType": "AWS::EC2::Subnet", "name": "Is contained in Subnet" }, { "resourceId": "vol-0a2d63a256bce35c5", "resourceName": null, "resourceType": "AWS::EC2::Volume", "name": "Is attached to Volume" }, { "resourceId": "vpc-14400670", "resourceName": null, "resourceType": "AWS::EC2::VPC", "name": "Is contained in Vpc" } ], "configuration": { "instanceId": "i-007d374c8912e3e90", "imageId": "ami-9be6f38c", "state": { "code": 16, "name": "running" }, "privateDnsName": "ip-172-31-16-84.ec2.internal", "publicDnsName": "ec2-54-175-43-43.compute-1.amazonaws.com", "stateTransitionReason": "", "keyName": "ec2-micro", "amiLaunchIndex": 0, "productCodes": [], "instanceType": "t2.micro", "launchTime": "2017-01-09T20:13:28.000Z", "placement": { "availabilityZone": "us-east-2c", "groupName": "", "tenancy": "default", "hostId": null, "affinity": null }, "kernelId": null, "ramdiskId": null, "platform": null, "monitoring": {"state": "disabled"}, "subnetId": "subnet-2372be7b", "vpcId": "vpc-14400670", "privateIpAddress": "172.31.16.84", "publicIpAddress": "54.175.43.43", "stateReason": null, "architecture": "x86_64", "rootDeviceType": "ebs", "rootDeviceName": "/dev/xvda", "blockDeviceMappings": [{ "deviceName": "/dev/xvda", "ebs": { "volumeId": "vol-0a2d63a256bce35c5", "status": "attached", "attachTime": "2017-01-09T19:36:03.000Z", "deleteOnTermination": true } }], "virtualizationType": "hvm", "instanceLifecycle": null, "spotInstanceRequestId": null, "clientToken": "bIYqA1483990561516", "tags": [{ "key": "Name", "value": "value" }], "securityGroups": [{ "groupName": "example-security-group-2", "groupId": "sg-3f1fef43" }], "sourceDestCheck": true, "hypervisor": "xen", "networkInterfaces": [{ "networkInterfaceId": "eni-fde9493f", "subnetId": "subnet-2372be7b", "vpcId": "vpc-14400670", "description": "", "ownerId": "123456789012", "status": "in-use", "macAddress": "0e:36:a2:2d:c5:e0", "privateIpAddress": "172.31.16.84", "privateDnsName": "ip-172-31-16-84.ec2.internal", "sourceDestCheck": true, "groups": [{ "groupName": "example-security-group-2", "groupId": "sg-3f1fef43" }], "attachment": { "attachmentId": "eni-attach-85bd89d9", "deviceIndex": 0, "status": "attached", "attachTime": "2017-01-09T19:36:02.000Z", "deleteOnTermination": true }, "association": { "publicIp": "54.175.43.43", "publicDnsName": "ec2-54-175-43-43.compute-1.amazonaws.com", "ipOwnerId": "amazon" }, "privateIpAddresses": [{ "privateIpAddress": "172.31.16.84", "privateDnsName": "ip-172-31-16-84.ec2.internal", "primary": true, "association": { "publicIp": "54.175.43.43", "publicDnsName": "ec2-54-175-43-43.compute-1.amazonaws.com", "ipOwnerId": "amazon" } }] }], "iamInstanceProfile": null, "ebsOptimized": false, "sriovNetSupport": null, "enaSupport": true }, "supplementaryConfiguration": {}, "tags": {"Name": "value"}, "configurationItemVersion": "1.2", "configurationItemCaptureTime": "2017-01-09T22:50:14.328Z", "configurationStateId": 1484002214328, "awsAccountId": "123456789012", "configurationItemStatus": "OK", "resourceType": "AWS::EC2::Instance", "resourceId": "i-007d374c8912e3e90", "resourceName": null, "ARN": "arn:aws:ec2:us-east-2:123456789012:instance/i-007d374c8912e3e90", "awsRegion": "us-east-2", "availabilityZone": "us-east-2c", "configurationStateMd5Hash": "8d0f41750f5965e0071ae9be063ba306", "resourceCreationTime": "2017-01-09T20:13:28.000Z" }, "notificationCreationTime": "2017-01-09T22:50:15.928Z", "messageType": "ConfigurationItemChangeNotification", "recordVersion": "1.2" }, "Timestamp": "2017-01-09T22:50:16.358Z", "SignatureVersion": "1", "Signature": "lpJTEYOSr8fUbiaaRNw1ECawJFVoD7I67mIeEkfAWJkqvvpak1ULHLlC+I0sS/01A4P1Yci8GSK/cOEC/O2XBntlw4CAtbMUgTQvb345Z2YZwcpK0kPNi6v6N51DuZ/6DZA8EC+gVTNTO09xtNIH8aMlvqyvUSXuh278xayExC5yTRXEg+ikdZRd4QzS7obSK1kgRZWI6ipxPNL6rd56/VvPxyhcbS7Vm40/2+e0nVb3bjNHBxjQTXSs1Xhuc9eP2gEsC4Sl32bGqdeDU1Y4dFGukuzPYoHuEtDPh+GkLUq3KeiDAQshxAZLmOIRcQ7iJ/bELDJTN9AcX6lqlDZ79w==", "SigningCertURL": "https://sns.us-east-2.amazonaws.com/SimpleNotificationService-b95095beb82e8f6a046b3aafc7f4149a.pem", "UnsubscribeURL": "https://sns.us-east-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-east-2:123456789012:config-topic-ohio:956fe658-0ce3-4fb3-b409-a45f22a3c3d4" }
Pemberitahuan ini berisi perubahan item konfigurasi untuk grup keamanan EC2sg-3f1fef43, yang terkait dengan instance.
{ "Type": "Notification", "MessageId": "564d873e-711e-51a3-b48c-d7d064f65bf4", "TopicArn": "arn:aws:sns:us-east-2:123456789012:config-topic-ohio", "Subject": "[AWS Config:us-east-2] AWS::EC2::SecurityGroup sg-3f1fef43 Created in Account 123456789012", "Message": { "configurationItemDiff": { "changedProperties": {}, "changeType": "CREATE" }, "configurationItem": { "relatedEvents": [], "relationships": [{ "resourceId": "vpc-14400670", "resourceName": null, "resourceType": "AWS::EC2::VPC", "name": "Is contained in Vpc" }], "configuration": { "ownerId": "123456789012", "groupName": "example-security-group-2", "groupId": "sg-3f1fef43", "description": "This is an example security group.", "ipPermissions": [], "ipPermissionsEgress": [{ "ipProtocol": "-1", "fromPort": null, "toPort": null, "userIdGroupPairs": [], "ipRanges": ["0.0.0.0/0"], "prefixListIds": [] }], "vpcId": "vpc-14400670", "tags": [] }, "supplementaryConfiguration": {}, "tags": {}, "configurationItemVersion": "1.2", "configurationItemCaptureTime": "2017-01-09T22:50:15.156Z", "configurationStateId": 1484002215156, "awsAccountId": "123456789012", "configurationItemStatus": "ResourceDiscovered", "resourceType": "AWS::EC2::SecurityGroup", "resourceId": "sg-3f1fef43", "resourceName": null, "ARN": "arn:aws:ec2:us-east-2:123456789012:security-group/sg-3f1fef43", "awsRegion": "us-east-2", "availabilityZone": "Not Applicable", "configurationStateMd5Hash": "7399608745296f67f7fe1c9ca56d5205", "resourceCreationTime": null }, "notificationCreationTime": "2017-01-09T22:50:16.021Z", "messageType": "ConfigurationItemChangeNotification", "recordVersion": "1.2" }, "Timestamp": "2017-01-09T22:50:16.413Z", "SignatureVersion": "1", "Signature": "GocX31Uu/zNFo85hZqzsNy30skwmLnjPjj+UjaJzkih+dCP6gXYGQ0bK7uMzaLL2C/ibYOOsT7I/XY4NW6Amc5T46ydyHDjFRtQi8UfUQTqLXYRTnpOO/hyK9lMFfhUNs4NwQpmx3n3mYEMpLuMs8DCgeBmB3AQ+hXPhNuNuR3mJVgo25S8AqphN9O0okZ2MKNUQy8iJm/CVAx70TdnYsfUMZ24n88bUzAfiHGzc8QTthMdrFVUwXxa1h/7Zl8+A7BwoGmjo7W8CfLDVwaIQv1Uplgk3qd95Z0AXOzXVxNBQEi4k8axcknwjzpyO1g3rKzByiQttLUQwkgF33op9wg==", "SigningCertURL": "https://sns.us-east-2.amazonaws.com/SimpleNotificationService-b95095beb82e8f6a046b3aafc7f4149a.pem", "UnsubscribeURL": "https://sns.us-east-2.amazonaws.com/?Action=Unsubscribe&SubscriptionArn=arn:aws:sns:us-east-2:123456789012:config-topic-ohio:956fe658-0ce3-4fb3-b409-a45f22a3c3d4" }
Memahami configurationItemDiff bidang di notifikasi Amazon SNS ConfigurationItemChangeNotification
AWS Config membuat item konfigurasi setiap kali konfigurasi sumber daya berubah (buat/perbarui/hapus). Untuk daftar jenis sumber daya yang didukung yang AWS Config dapat merekam, lihatJenis Sumber Daya yang Didukung. AWS Config menggunakan Amazon SNS untuk mengirimkan pemberitahuan saat perubahan terjadi. Payload notifikasi Amazon SNS menyertakan bidang untuk membantu Anda melacak perubahan sumber daya di Wilayah tertentu. AWS
Untuk memahami mengapa Anda menerima ConfigurationItemChangeNotification pemberitahuan, tinjau configurationItemDiff detailnya. Bidang bervariasi tergantung pada jenis perubahan dan dapat membentuk kombinasi yang berbeda seperti UPDATE-UPDATE, UPDATE-CREATE, dan DELETE-DELETE. Berikut ini adalah penjelasan dari beberapa kombinasi umum.
UPDATE-CREATE dan UPDATE-UPDATE
Contoh berikut mencakup perubahan dalam hubungan langsung sumber daya dan konfigurasi sumber daya. configurationItemDiffDetailnya mengungkapkan informasi berikut:
Tindakan yang dilakukan: Kebijakan terkelola yang ada di akun dilampirkan ke peran AWS Identity and Access Management (IAM).
Operasi dasar dilakukan: UPDATE (memperbarui jumlah asosiasi jenis sumber daya AWS::IAM::Policy dalam akun).
Ubah kombinasi tipe:
Perubahan hubungan langsung sumber daya UPDATE-CREATE. Lampiran atau asosiasi baru dibuat antara kebijakan IAM dan peran IAM.
Perubahan konfigurasi sumber daya UPDATE-UPDATE. Jumlah asosiasi kebijakan IAM meningkat dari 2 menjadi 3 ketika kebijakan dilampirkan pada peran IAM.
Contoh pemberitahuan UPDATE-CREATE dan UPDATE-UPDATE: configurationItemDiff
{ "configurationItemDiff": { "changedProperties": { "Relationships.0": { "previousValue": null, "updatedValue": { "resourceId": "AROA6D3M4S53*********", "resourceName": "Test1", "resourceType": "AWS::IAM::Role", "name": "Is attached to Role" }, "changeType": "CREATE" >>>>>>>>>>>>>>>>>>>> 1 }, "Configuration.AttachmentCount": { "previousValue": 2, "updatedValue": 3, "changeType": "UPDATE" >>>>>>>>>>>>>>>>>>>> 2 } }, "changeType": "UPDATE" } }
PEMBARUAN-HAPUS
Contoh berikut mencakup perubahan dalam hubungan langsung sumber daya dan konfigurasi sumber daya. configurationItemDiffDetailnya mengungkapkan informasi berikut:
Tindakan dilakukan: Kebijakan terkelola yang ada di akun terlepas dari pengguna IAM.
Operasi dasar dilakukan: UPDATE (memperbarui kebijakan izin yang terkait dengan jenis sumber dayaAWS::IAM::User).
Ubah kombinasi tipe: Perubahan hubungan langsung sumber daya UPDATE-DELETE. Hubungan antara pengguna IAM dan kebijakan IAM di akun telah dihapus.
Contoh pemberitahuan UPDATE-DELETEconfigurationItemDiff:
{ "configurationItemDiff": { "changedProperties": { "Configuration.UserPolicyList.0": { "previousValue": { "policyName": "Test2", "policyDocument": "{ "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": "ec2:RunInstances", "Resource": "arn:aws:ec2:*:*:instance/*", "Condition": { "StringLike": { "aws:RequestTag/VPCId": "*" } } } ] }" }, "updatedValue": null, "changeType": "DELETE" >>>>>>>>>>>>>>>>>>>> 3 } }, "changeType": "UPDATE" } }
HAPUS-HAPUS
Contoh berikut mencakup perubahan dalam hubungan langsung sumber daya dan konfigurasi sumber daya. configurationItemDiffDetailnya mengungkapkan informasi berikut:
Tindakan yang dilakukan: Peran IAM yang ada di akun telah dihapus.
Operasi dasar dilakukan: DELETE (sumber daya dari jenis sumber daya AWS::IAM::Role dihapus).
Ubah kombinasi tipe: Perubahan hubungan langsung sumber daya dan perubahan konfigurasi sumber daya DELETE-DELETE. Penghapusan peran IAM juga menghapus asosiasi kebijakan IAM dengan peran IAM.
Contoh pemberitahuan HAPUS-HAPUSconfigurationItemDiff:
{ "configurationItemDiff": { "changedProperties": { "Relationships.0": { "previousValue": { "resourceId": "ANPAIJ5MXUKK*********", "resourceName": "AWSCloudTrailAccessPolicy", "resourceType": "AWS::IAM::Policy", "name": "Is attached to CustomerManagedPolicy" }, "updatedValue": null, "changeType": "DELETE" }, "Configuration": { "previousValue": { "path": "/", "roleName": "CloudTrailRole", "roleId": "AROAJITJ6YGM*********", "arn": "arn:aws:iam::123456789012:role/CloudTrailRole", "createDate": "2017-12-06T10:27:51.000Z", "assumeRolePolicyDocument": "{"Version":"2012-10-17","Statement":[{"Sid":"","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":"sts:AssumeRole","Condition":{"StringEquals":{"sts:ExternalId":"123456"}}}]}", "instanceProfileList": [], "rolePolicyList": [], "attachedManagedPolicies": [ { "policyName": "AWSCloudTrailAccessPolicy", "policyArn": "arn:aws:iam::123456789012:policy/AWSCloudTrailAccessPolicy" } ], "permissionsBoundary": null, "tags": [], "roleLastUsed": null }, "updatedValue": null, "changeType": "DELETE" } }, "changeType": "DELETE" }
