# 为 Amazon Bedrock AgentCore Gateway 资源启用 CloudTrail 数据事件记录
<a name="enabling-cloudtrail-data-event-logging"></a>

您可以使用 CloudTrail 数据事件来获取有关 Amazon Bedrock AgentCore Gateway 请求的信息。要为 Gateway 启用 CloudTrail 数据事件，您必须在 Amazon S3 存储桶 CloudTrail 支持下手动创建跟踪。

 **重要注意事项** 
+ 数据事件记录会产生额外费用。您必须明确启用数据事件，因为默认情况下不会捕获这些事件。检查以确保您的账户启用了数据事件。
+ 使用生成高工作负载的网关，您可以在短时间内快速生成数千条日志。请注意您选择为繁忙的网关启用 CloudTrail 数据事件多长时间。
+ CloudTrail 将网关数据事件日志存储在您选择的 Amazon S3 存储桶中。考虑在单独的 AWS 账户中使用存储桶，以便更好地将来自多个资源的事件组织到一个中心位置，以便于查询和分析。

在中记录跟踪的数据事件时 CloudTrail，必须使用高级事件选择器来记录网关操作的数据事件。

**Example**  

1. 要使用 AWS CLI 为网关资源启用 CloudTrail 数据事件，可以在终端中运行以下命令：

   ```
   aws cloudtrail put-event-selectors \
     --trail-name brac-gateway-canary-trail-prod-us-east-1 \
     --region us-east-1 \
     --advanced-event-selectors '[
       {
         "Name": "GatewayDataEvents",
         "FieldSelectors": [
           {
             "Field": "eventCategory",
             "Equals": ["Data"]
           },
           {
             "Field": "resources.type",
             "Equals": ["AWS::BedrockAgentCore::Gateway"]
           }
         ]
       }
     ]'
   ```

1. 以下示例演示如何使用 AWS CDK 创建包含 AgentCore 网关数据事件的 CloudTrail 跟踪：

   ```
   import { Construct } from 'constructs';
   import { Trail, CfnTrail } from 'aws-cdk-lib/aws-cloudtrail';
   import { Bucket } from 'aws-cdk-lib/aws-s3';
   import { Effect, PolicyStatement, ServicePrincipal } from 'aws-cdk-lib/aws-iam';
   import { RemovalPolicy } from 'aws-cdk-lib';
   
   export interface DataEventTrailProps {
     /**
      * Whether to enable multi-region trail
      */
     isMultiRegionTrail?: boolean;
   
     /**
      * Whether to include global service events
      */
     includeGlobalServiceEvents?: boolean;
   
     /**
      * AWS region
      */
     region: string;
   
     /**
      * Environment account ID
      */
     account: string;
   }
   
   /**
    * Creates a CloudTrail trail configured to capture data events for Bedrock Agent Core Gateway
    */
   export class BedrockAgentCoreDataEventTrail extends Construct {
     /**
      * The CloudTrail trail
      */
     public readonly trail: Trail;
   
     /**
      * The S3 bucket for CloudTrail logs
      */
     public readonly logsBucket: Bucket;
   
     constructor(scope: Construct, id: string, props: DataEventTrailProps) {
       super(scope, id);
   
       // Create S3 bucket for CloudTrail logs
       const bucketName = `brac-gateway-cloudtrail-logs-${props.account}-${props.region}`;
       this.logsBucket = new Bucket(this, 'CloudTrailLogsBucket', {
         bucketName,
         removalPolicy: RemovalPolicy.RETAIN,
       });
   
       // Create trail name (suffixing region since regional trail)
       const trailName = `brac-gateway-trail-${props.region}`;
   
       // Add CloudTrail bucket policy
       this.logsBucket.addToResourcePolicy(
         new PolicyStatement({
           sid: 'AWSCloudTrailAclCheck',
           effect: Effect.ALLOW,
           principals: [new ServicePrincipal('cloudtrail.amazonaws.com')],
           actions: ['s3:GetBucketAcl'],
           resources: [this.logsBucket.bucketArn],
           conditions: {
             StringEquals: {
               'aws:SourceArn': `arn:aws:cloudtrail:${props.region}:${props.account}:trail/${trailName}`,
             },
           },
         }),
       );
   
       this.logsBucket.addToResourcePolicy(
         new PolicyStatement({
           sid: 'AWSCloudTrailWrite',
           effect: Effect.ALLOW,
           principals: [new ServicePrincipal('cloudtrail.amazonaws.com')],
           actions: ['s3:PutObject'],
           resources: [this.logsBucket.arnForObjects(`AWSLogs/${props.account}/*`)],
           conditions: {
             StringEquals: {
               's3:x-amz-acl': 'bucket-owner-full-control',
               'aws:SourceArn': `arn:aws:cloudtrail:${props.region}:${props.account}:trail/${trailName}`,
             },
           },
         }),
       );
   
       // Create CloudTrail trail
       this.trail = new Trail(this, 'GatewayDataEventTrail', {
         trailName,
         bucket: this.logsBucket,
         isMultiRegionTrail: props.isMultiRegionTrail ?? false,
         includeGlobalServiceEvents: props.includeGlobalServiceEvents ?? true,
         enableFileValidation: true,
       });
   
       // Add advanced event selectors for Bedrock Agent Core Gateway data events
       const cfnTrail = this.trail.node.defaultChild as CfnTrail;
   
       // Define the advanced event selectors
       const advancedEventSelectors = [
         {
           // Log Bedrock Agent Core Gateway Data Events only
           fieldSelectors: [
             {
               field: 'eventCategory',
               equalTo: ['Data'],
             },
             {
               field: 'resources.type',
               equalTo: ['AWS::BedrockAgentCore::Gateway'],
             },
           ],
         },
       ];
   
       // Clear any existing event selectors and set advanced event selectors
       cfnTrail.eventSelectors = undefined;
       cfnTrail.advancedEventSelectors = advancedEventSelectors;
     }
   }
   ```