CloudTrail 감사 로깅

# EC2 인스턴스 생성(RunInstances) 이벤트 조회
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=RunInstances \
  --max-results 5 \
  --region ap-northeast-2

# S3 버킷 생성(CreateBucket) 이벤트 조회
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=CreateBucket \
  --max-results 5 \
  --region ap-northeast-2

# IAM 역할 생성(CreateRole) 이벤트 조회
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=CreateRole \
  --max-results 5 \
  --region ap-northeast-2

# 결과를 보기 좋게 포맷팅
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=RunInstances \
  --max-results 3 \
  --region ap-northeast-2 \
  --query "Events[].{Time:EventTime, Name:EventName, User:Username, Source:EventSource}" \
  --output table

# 계정 ID 확인
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
echo "Account ID: $ACCOUNT_ID"

# 1. CloudTrail 로그용 S3 버킷 생성
aws s3api create-bucket \
  --bucket shopeasy-cloudtrail-${ACCOUNT_ID} \
  --region ap-northeast-2 \
  --create-bucket-configuration LocationConstraint=ap-northeast-2

# 2. S3 버킷 정책 설정 (CloudTrail이 버킷에 로그를 쓸 수 있도록 허용)
cat > /tmp/cloudtrail-bucket-policy.json << EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AWSCloudTrailAclCheck",
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudtrail.amazonaws.com"
      },
      "Action": "s3:GetBucketAcl",
      "Resource": "arn:aws:s3:::shopeasy-cloudtrail-${ACCOUNT_ID}"
    },
    {
      "Sid": "AWSCloudTrailWrite",
      "Effect": "Allow",
      "Principal": {
        "Service": "cloudtrail.amazonaws.com"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::shopeasy-cloudtrail-${ACCOUNT_ID}/AWSLogs/${ACCOUNT_ID}/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-acl": "bucket-owner-full-control"
        }
      }
    }
  ]
}
EOF

aws s3api put-bucket-policy \
  --bucket shopeasy-cloudtrail-${ACCOUNT_ID} \
  --policy file:///tmp/cloudtrail-bucket-policy.json

# 3. CloudTrail 추적 생성
aws cloudtrail create-trail \
  --name ShopEasy-Trail \
  --s3-bucket-name shopeasy-cloudtrail-${ACCOUNT_ID} \
  --is-multi-region-trail \
  --region ap-northeast-2

# 4. 로깅 시작
aws cloudtrail start-logging \
  --name ShopEasy-Trail \
  --region ap-northeast-2

# 5. 추적 상태 확인
aws cloudtrail get-trail-status \
  --name ShopEasy-Trail \
  --region ap-northeast-2

# 6. 추적 설정 확인
aws cloudtrail describe-trails \
  --trail-name-list ShopEasy-Trail \
  --region ap-northeast-2

# 계정 ID 확인
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)

# S3 버킷 내용 확인 (재귀적으로 첫 10개 파일)
aws s3 ls s3://shopeasy-cloudtrail-${ACCOUNT_ID}/ --recursive | head -10

# 특정 날짜의 로그 파일 확인 (오늘 날짜로 변경)
TODAY=$(date +%Y/%m/%d)
aws s3 ls s3://shopeasy-cloudtrail-${ACCOUNT_ID}/AWSLogs/${ACCOUNT_ID}/CloudTrail/ap-northeast-2/${TODAY}/

# 로그 파일 다운로드 및 내용 확인 (첫 번째 파일)
FIRST_LOG=$(aws s3 ls s3://shopeasy-cloudtrail-${ACCOUNT_ID}/ --recursive | head -1 | awk '{print $4}')
if [ -n "$FIRST_LOG" ]; then
  aws s3 cp s3://shopeasy-cloudtrail-${ACCOUNT_ID}/${FIRST_LOG} /tmp/cloudtrail-log.json.gz
  gunzip -f /tmp/cloudtrail-log.json.gz
  python3 -m json.tool /tmp/cloudtrail-log.json | head -50
fi

# CreateBucket 이벤트 검색
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=CreateBucket \
  --region ap-northeast-2

# CreateTrail 이벤트 검색 (방금 만든 Trail 생성 기록)
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=CreateTrail \
  --region ap-northeast-2

# 특정 사용자의 활동 검색
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=admin \
  --max-results 10 \
  --region ap-northeast-2

# 결과를 보기 좋게 요약
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=Username,AttributeValue=admin \
  --max-results 10 \
  --region ap-northeast-2 \
  --query "Events[].{Time:EventTime, Event:EventName, Source:EventSource}" \
  --output table

# 시간 범위 지정 검색 (예: 오늘 하루)
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=CreateTrail \
  --start-time $(date -u -d "today 00:00:00" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -v0H -v0M -v0S +%Y-%m-%dT%H:%M:%SZ) \
  --end-time $(date -u +%Y-%m-%dT%H:%M:%SZ) \
  --region ap-northeast-2