用于数据事件的亚马逊网络服务CloudTrail自定义选择器

Question

我只想为几个S3存储桶启用CloudTrail数据事件。我有以下选择器：

[
  {
    "name": "Deletes CT selector",
    "fieldSelectors": [
      {
        "field": "eventCategory",
        "equals": [
          "Data"
        ]
      },
      {
        "field": "resources.type",
        "equals": [
          "AWS::S3::Object"
        ]
      },
      {
        "field": "eventName",
        "startsWith": [
          "Delete"
        ]
      },
      {
        "field": "resources.ARN",
        "startsWith": [
          "arn:aws:s3:::bucket-1/",
          "arn:aws:s3:::bucket-2/",
          "arn:aws:s3:::bucket-3/"
        ]
      },
      {
        "field": "readOnly",
        "equals": [
          "false"
        ]
      }
    ]
  }
]

当我尝试通过删除某个对象进行测试时，我可以看到删除之前和之后的所有其他相关事件，但没有DeleteObject或DeleteObjects，根本没有删除事件。我在雅典娜加载日志并在那里检查，还手动检查了由CloudTrails生成的压缩json。无删除事件。

是否有人成功地在CloudTrail中设置了此场景？

Answer 1

我想我也有类似的问题，使用startWith = DeleteObject而不是Delete。

过了一段时间，事实证明事件只是被推迟了。工作设置：

[
  {
    "name": "abc",
    "fieldSelectors": [
      {
        "field": "eventCategory",
        "equals": [
          "Data"
        ]
      },
      {
        "field": "resources.type",
        "equals": [
          "AWS::S3::Object"
        ]
      },
      {
        "field": "eventName",
        "startsWith": [
          "DeleteObject"
        ]
      },
      {
        "field": "resources.ARN",
        "startsWith": [
          "arn:aws:s3:::xxxxxx"
        ]
      }
    ]
  }
]