Sivakanth Mundru presented on Amazon Web Services CloudTrail. CloudTrail continuously records API calls made on AWS services and delivers log files to customers. The number of supported services has grown from 7 to over 30. CloudTrail logs can be used to determine who made a call, when, what action was performed, which resources were involved, and from/to where. It also records client errors, server errors, and authorization failures. Customers can aggregate logs across regions and accounts.

1. November 13 2014 | Las Vegas, Nevada
Sivakanth Mundru, Amazon Web Services

2. AgendaNewNew

4. Introduction to CloudTrail
Customers are making API calls...
On a growing set of services around the world…
CloudTrail is continuously recording API calls…
And delivering log files to customers

5. Use cases enabled by CloudTrail

6. CloudTrail Regional Availability

7. AWS Services supported by CloudTrail
7
8
16
21
24
0
5
10
15
20
25
30
# of AWS Services
Quarter/Year
Q4 2013
Q1 2014
Q2 2014
Q3 2014
Q4 2014

9. What can you answer using a CloudTrail event?
•Who
•When
•What
•Which
•Where

10. Who made the API call?

11. Example 1:Who?

12. Example 2:Who?

13. When? and What?
•When was the API call made?
•What was the API call made?

14. Which resources?, Where from? and Where to?
•Which resources were acted up on in the API call?
•Where was the API call made from and made to?

15. Client Errors, Server Errors & Authorization failures

16. Aggregate log files across regions and accounts

17. Amazon SNS notifications for log file delivery

19. CloudTrail Customer Story
Steve Toback
Cloud Architect, Merck and Company

21. Build Applications that process CloudTrail log files

22. How does CloudTrail Processing Library work?
AWS
CloudTrail
Amazon
SNS
Amazon
SQS
S3 Bucket
Amazon DynamoDB
Amazon Redshift
Third Party
Amazon CloudWatch
Amazon SNS
AWS CloudTrail
Processing Library

23. Sample CloudTrail Processing Library Code
publicvoidprocess(List<CloudTrailEvent> events) {
for(CloudTrailEvent event : events) {
CloudTrailEventData data = event.getEventData();
if(data.getEventSource().equals("ec2.amazonaws.com") &&
data.getEventName().equals("ModifyVpcAttribute")) {
System.out.println("Processing event: "+ data.getRequestId());
sns.publish(myQueueArn, "{ "+
"'requestId'= '"+ data.getRequestId() + "',"+
"'request'= '"+ data.getRequestParameters() + "',"+
"'response' = '"+ data.getResponseElements() + "',"+
"'source'= '"+ data.getEventSource() + "',"+
"'eventName'= '"+ data.getEventName() + "'"+
"}");
}
}
}
•Source available on GitHub and distributed under Apache 2.0 license

25. AWS Technology Partner solutions integrated with CloudTrail

26. AWS Consulting Partner solutions integrated with CloudTrail

28. CloudTrail integration with CloudWatch Logs

29. Demo: Receive notifications for failed console sign-in events

30. More Examples of Metric Filters

31. Additional ResourcesCloudTrail Detail PageCloudTrail FAQsCloudTrail PartnersCloudTrail Processing Library on GitHubCloudTrail documentation user guideSecurity at scale: Logging in AWS white paper

32. http://bit.ly/awsevals