Owner of Amazon EC2 instance / volume / snapshot?
我想知道在Amazon AWS EC2中创建实例/卷/实例时是否有任何方法可以找出使用哪些用户凭证。
If you enable CloudTrail, you can see information about API calls made with your AWS account. CloudTrail will stash json-formatted log files into a specified S3 bucket for you.
Here's a snippet of user metadata from the documentation where an IAM User named Alice made a request:
"userIdentity": {
"type": "IAMUser",
"principalId": "AIDAJDPLRKLG7UEXAMPLE",
"arn": "arn:aws:iam::123456789012:user/Alice",
"accountId": "123456789012",
"accessKeyId": "AKIAIOSFODNN7EXAMPLE",
"userName": "Alice",
"sessionContext": {
"attributes": {
"mfaAuthenticated": "false",
"creationDate": "2014-03-18T14:29:23Z"
}
}
You can find further information on the userIdentity element in the documentation.
For finding who created an instance, volume or snapshot... you'll want to search for eventName elements (this element describes the requested API action) that match: