如何使用PHP中的AWS SDK读取cloudTrail日志

时间:2018-01-29 11:41:01

标签: logging aws-sdk amazon-cloudtrail

我是AWS SDK API的新手。

我有一个s3存储桶(我的存储桶)用于我的客户端从那里下载文件。 每当我的客户端从" my-bucket"中下载文件时,我都会使用Trail(my-trail)将日志传送到另一个s3存储桶(my-bucket-logs)。

我想从" my-bucket-logs"中读取日志。并将它们保存在我的CMS中以生成各种报告。是否可以获取日志?我试过下面的PHP代码。我不确定这段代码是否正确。

require 'vendor/autoload.php';
$config = [
    'version' => 'latest',
    'region'  => 'us-east-1',
    'key' => MY_AWS_KEY,
    'secret'  => MY_AWS_SECRETE
];
$s3client = new Aws\S3\S3Client($config);
$trailClient = new Aws\CloudTrail\CloudTrailClient($config);


$result = $trailClient->lookupEvents([
    'EndTime' => time(),
    'LookupAttributes' => [
        [
            'AttributeKey' => 'eventName',// 'get', // REQUIRED
            'AttributeValue' => 'ListObjects' //get', // REQUIRED
        ],
        // ...
    ],
    'MaxResults' => 1000
    //'NextToken' => '<string>',
    //'StartTime' => '01/12/2017',
]);

print_r($result);

出现此错误:

PHP Fatal error:  Uncaught exception 'Aws\CloudTrail\Exception\CloudTrailException' with message 'Error executing "LookupEvents" on "https://cloudtrail.us-east-1.amazonaws.com"; AWS HTTP error: Client error: `POST https://cloudtrail.us-east-1.amazonaws.com` resulted in a `400 Bad Request` response:
{"__type":"InvalidLookupAttributesException","Message":"You cannot perform a lookup on this attribute key: EventId|Event (truncated...)
 InvalidLookupAttributesException (client): You cannot perform a lookup on this attribute key: EventId|EventName|Username|ResourceType|ResourceName|EventSource - {"__type":"InvalidLookupAttributesException","Message":"You cannot perform a lookup on this attribute key: EventId|EventName|Username|ResourceType|ResourceName|EventSource"}'

exception 'GuzzleHttp\Exception\ClientException' with message 'Client error: `POST https://cloudtrail.us-east-1.amazonaws.com` resulted in a `400 Bad Request` response:
{"__type":"InvalidLookupAttributesException","Message":"You cannot perform a lookup on this attribu in /home/shahid/webroot/shahid/aws/sdk/vendor/aws/aws-sdk-php/src/WrappedHttpHandler.php on line 191

是否可以使用PHP中的AWS SDK API获取日志?

1 个答案:

答案 0 :(得分:0)

我能够从s3存储桶中读取日志。这只是从s3存储桶本身下载文件的问题,我使用Aws \ CloudTrail \ CloudTrailClient搞乱了。

Sub Sundry_AllFiles(wb1, wbsource, rl, wsctrl, Mths6, Mths12)
(==Declared elsewhere - Dim wb1,wbsource as Workbook
Set wb1 = ThisWorkbook
Set wbsource = Workbooks.Open(FPath & Finame, ReadOnly:=True, Local:=True)
===)
Dim ws As Worksheet
Dim r, rw As Long
Dim fnd As String
Dim fnm As String

fnd = "TOTAL"
fnm = wbsource.Name
Set ws = wb1.Worksheets("Sundry")

'=====Macro runs from wb1 and analyses data in the wbsource

If IsEmpty(Range("A1")) = True Then
wbsource.Close SaveChanges:=False
Exit Sub

Else
            Application.CutCopyMode = False 'POSSIBLE SOLUTION DELETE IF DIDNT WORK
            Columns("A:A").Select
            Selection.Insert shift:=xlToRight, CopyOrigin:=xlFormatFromLeftOrAbove
            With wbsource.Worksheets(1)
                    For rw = 2 To .Cells(Rows.Count, 6).End(xlUp).Row
                    .Cells(rw, 1) = Application.VLookup(fnd, wbsource.Worksheets(1). _
                    Range("B:E"),4, False)
                    Next rw

                For rw = 2 To .Cells(Rows.Count, 1).End(xlUp).Row
                .Cells(rw, 15) = "=IF(RC[-13]<=TODAY()-90,""Yes"",""No"")"
                Next rw
                .AutoFilterMode = False
            End With

            'Autofilter by tranDate>90 days, copy and append to the ws sheet
            With Range("N" & Rows.Count).End(xlUp)
            .AutoFilter 15, "Yes"
            With wbsource.Worksheets(1)
            Dim LR As Long
            On Error Resume Next
            LR = Range("N" & Rows.Count).End(xlUp).Row
            Range("A2:N" & LR).SpecialCells(xlCellTypeVisible).Copy _
Destination:=wb1.ws.Cells(Rows.Count, 1).End(xlUp).Offset(1, 0)

'#Alternative to Copy Destination that works
            'wb1.Activate
            'ws.Range("a" & Rows.Count).End(xlUp).Offset(1).PasteSpecial

            End With
            End With

            wbsource.Close SaveChanges:=False
End If
End Sub