本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

# 监控 AWS 支持 授权 AWS CloudTrail
<a name="support-authorization-monitoring"></a>

AWS CloudTrail 将所有 AWS 支持 授权 API 调用和支持操作记录为管理事件。默认情况下，无需额外配置即可记录这些事件。

## AWS 服务事件
<a name="support-authorization-monitoring-service-events"></a>

当 AWS 支持 执行与您的支持许可相关的操作时， AWS CloudTrail 将以下事件作为`AwsServiceEvent`类型传送。所有事件的事件源都是`supportauthz.amazonaws.com`。

### SupportPermitRequestCreated
<a name="support-authorization-monitoring-request"></a>

AWS CloudTrail 在 AWS 支持 请求访问您的资源时记录此事件。它表示支持许可请求已创建。

```
{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "111122223333",
        "invokedBy": "supportauthz.amazonaws.com"
    },
    "eventTime": "2026-06-16T20:04:51Z",
    "eventSource": "supportauthz.amazonaws.com",
    "eventName": "SupportPermitRequestCreated",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "supportauthz.amazonaws.com",
    "userAgent": "supportauthz.amazonaws.com",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "readOnly": false,
    "resources": [
        {
            "accountId": "111122223333",
            "type": "AWS::SupportAuthZ::SupportPermitRequest",
            "ARN": "arn:aws:supportauthz:us-east-1:111122223333:supportpermitrequest/e5f6a7b8-c9d0-1234-efab-345678901234"
        }
    ],
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "supportPermitRequestArn": "arn:aws:supportauthz:us-east-1:111122223333:supportpermitrequest/e5f6a7b8-c9d0-1234-efab-345678901234",
        "supportCaseDisplayId": "1234567890",
        "resources": ["arn:aws:example:us-east-1:111122223333:resourcetype/resource-id"],
        "actions": ["example:ExampleAction"]
    },
    "eventCategory": "Management"
}
```

### RetrieveSupportPermit
<a name="support-authorization-monitoring-get"></a>

AWS CloudTrail 在 AWS 支持 检索已签名的授权以执行支持操作时记录此事件。这表明您的 AWS KMS 密钥已用于签署授权。

```
{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "111122223333",
        "invokedBy": "supportauthz.amazonaws.com"
    },
    "eventTime": "2026-06-16T20:22:42Z",
    "eventSource": "supportauthz.amazonaws.com",
    "eventName": "RetrieveSupportPermit",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "supportauthz.amazonaws.com",
    "userAgent": "supportauthz.amazonaws.com",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
    "readOnly": true,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "supportCaseDisplayId": "1234567890",
        "resource": "arn:aws:example:us-east-1:111122223333:resourcetype/resource-id",
        "action": "example:ExampleAction",
        "supportPermitArn": "arn:aws:supportauthz:us-east-1:111122223333:supportpermit/f6a7b8c9-d0e1-2345-fabc-456789012345"
    },
    "eventCategory": "Management"
}
```

### StartSupportAction
<a name="support-authorization-monitoring-execute"></a>

AWS CloudTrail 在对您的资源 AWS 支持 执行授权操作时记录此事件。

```
{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "111122223333",
        "invokedBy": "supportauthz.amazonaws.com"
    },
    "eventTime": "2026-06-17T21:38:37Z",
    "eventSource": "supportauthz.amazonaws.com",
    "eventName": "StartSupportAction",
    "awsRegion": "us-west-2",
    "sourceIPAddress": "supportauthz.amazonaws.com",
    "userAgent": "supportauthz.amazonaws.com",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "c3d4e5f6-a7b8-9012-cdef-123456789012",
    "readOnly": false,
    "resources": [
        {
            "accountId": "111122223333",
            "type": "AWS::SupportAuthZ::SupportPermit",
            "ARN": "arn:aws:supportauthz:us-west-2:111122223333:supportpermit/example-permit"
        }
    ],
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "supportCaseDisplayId": "1234567890",
        "resourceIdentifiers": ["arn:aws:example:us-east-1:111122223333:resourcetype/resource-id"],
        "action": "example:ExampleAction",
        "supportPermitArn": "arn:aws:supportauthz:us-east-1:111122223333:supportpermit/f6a7b8c9-d0e1-2345-fabc-456789012345"
    },
    "eventCategory": "Management"
}
```

**注意**  
一次签名的授权可能导致多个`StartSupportAction`事件。每个事件代表对一个资源执行的一项操作。例如，如果在支持案例期间多次从集群 AWS 支持 读取诊断数据，则每次访问都会生成一个引用相同`customerPermitArn`数据的单独`StartSupportAction`事件。

### CancelSupportPermitRequest
<a name="support-authorization-monitoring-cancel"></a>

AWS CloudTrail AWS 支持 取消支持许可请求时记录此事件。

```
{
    "eventVersion": "1.11",
    "userIdentity": {
        "accountId": "111122223333",
        "invokedBy": "supportauthz.amazonaws.com"
    },
    "eventTime": "2026-06-16T20:04:42Z",
    "eventSource": "supportauthz.amazonaws.com",
    "eventName": "CancelSupportPermitRequest",
    "awsRegion": "us-east-1",
    "sourceIPAddress": "supportauthz.amazonaws.com",
    "userAgent": "supportauthz.amazonaws.com",
    "requestParameters": null,
    "responseElements": null,
    "eventID": "d4e5f6a7-b8c9-0123-defa-234567890123",
    "readOnly": false,
    "resources": [
        {
            "accountId": "111122223333",
            "type": "AWS::SupportAuthZ::SupportPermitRequest",
            "ARN": "arn:aws:supportauthz:us-east-1:111122223333:supportpermitrequest/a7b8c9d0-e1f2-3456-abcd-567890123456"
        }
    ],
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": "111122223333",
    "serviceEventDetails": {
        "supportPermitRequestArn": "arn:aws:supportauthz:us-east-1:111122223333:supportpermitrequest/a7b8c9d0-e1f2-3456-abcd-567890123456"
    },
    "eventCategory": "Management"
}
```

## API 事件
<a name="support-authorization-monitoring-customer-events"></a>

AWS CloudTrail 还会为您自己的 API AWS 支持 授权调用生成标准管理事件`CreateSupportPermit`，包括`DeleteSupportPermit`、`GetSupportPermit`、`ListSupportPermits`、`ListSupportPermitRequests`、和`RejectSupportPermitRequest`。

## 设置警报
<a name="support-authorization-monitoring-alerts"></a>

您可以根据 AWS CloudTrail 事件创建 Amazon CloudWatch 警报，以便在 AWS 支持 请求访问您的资源或对您的资源执行操作时提醒您。要设置警报，请执行以下操作：

1. 创建 AWS CloudTrail 一条向 Amazon CloudWatch 日志传输事件的跟踪。

1. 为 AWS CloudTrail 日志组创建指标筛选条件，使其在`eventSource`值`supportauthz.amazonaws.com`和所需值上相匹配`eventName`（例如`SupportPermitRequestCreated`或`StartSupportAction`）。

1. 在指标筛选条件上创建 CloudWatch 警报，通过 Amazon SNS 通知您。

## 亚马逊 EventBridge 活动
<a name="support-authorization-monitoring-eventbridge"></a>

创建支持许可请求 EventBridge 后，事件就会发送到 Amazon。您可以使用这些事件来自动响应，例如自动为低风险操作创建支持许可或通知您的安全团队进行审查。

以下是新的支持许可请求的示例事件：

```
{
    "version": "0",
    "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "detail-type": "Support Permit Request Created",
    "source": "aws.supportauthz",
    "account": "111122223333",
    "time": "2026-06-01T12:00:00Z",
    "region": "us-east-1",
    "detail": {
        "requestArn": "arn:aws:supportauthz:us-east-1:111122223333:supportpermitrequest/req-1234abcd",
        "supportCaseDisplayId": "case-12345678",
        "requestedActions": ["rds:ReadClusterData"],
        "requestedResources": ["arn:aws:rds:us-east-1:111122223333:cluster:my-aurora-cluster"],
        "status": "PENDING"
    }
}
```

要创建与支持许可请求事件相匹配的 Amazon EventBridge 规则，请使用以下事件模式：

```
{
    "source": ["aws.supportauthz"],
    "detail-type": ["Support Permit Request Created"]
}
```

您可以将这些事件路由到 Lambda 函数、Amazon SNS 主题或 Amazon SQS 队列等目标，以构建自动批准工作流程。