本文為英文版的機器翻譯版本，如內容有任何歧義或不一致之處，概以英文版為準。

# Monitor Connector for SCEP
<a name="c4scep-monitoring-overview"></a>

監控是維護 Connector for SCEP 及其他 AWS 解決方案的可靠性、可用性和效能的重要部分。 AWS 提供下列監控工具來監看 Connector for SCEP、在發生錯誤時回報，並適時採取自動動作：
+ *AWS CloudTrail* 擷取您 AWS 帳戶 發出或代表發出的 API 呼叫和相關事件，並傳送日誌檔案至您指定的 Amazon S3 儲存貯體。您可以識別哪些使用者和帳戶稱為 AWS APIs、進行呼叫的來源 IP 地址，以及呼叫的時間。

  如果您監控 CloudTrail 資料事件，日誌會包含來自用戶端裝置的所有最近請求清單。資料事件隨附識別用戶端裝置資訊，例如 IP 地址、執行的操作類型，以及操作導致 `failed` 狀態時的錯誤碼和詳細訊息。如需詳細資訊，請參閱[「AWS CloudTrail 使用者指南」](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/)。
+ *Amazon EventBridge* 為無伺服器事件匯流排服務，可讓您輕鬆將應用程式與來自各種來源的資料互相連線。EventBridge 會從您自己的應用程式、Software-as-a-Service(SaaS) 應用程式 AWS 和服務提供即時資料串流，並將該資料路由至 Lambda 和 CloudWatch Logs 等目標。這可讓您監控在服務中發生的事件，並建置事件導向的架構。如需詳細資訊，請參閱 [Amazon EventBridge 使用者指南](https://docs.aws.amazon.com/eventbridge/latest/userguide/)。

**Topics**
+ [使用 EventBridge 自動化 SCEP 的連接器](c4scep-monitor-eventbridge-events.md)
+ [使用 的 Log Connector for SCEP API 呼叫 AWS CloudTrail](logging-using-cloudtrail-c4scep.md)

# 使用 EventBridge 自動化 SCEP 的連接器
<a name="c4scep-monitor-eventbridge-events"></a>

您可以使用 [Amazon EventBridge](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-cwe-now-eb.html) 自動化您的 AWS 服務，並自動回應系統事件，例如應用程式可用性問題或資源變更。 AWS 服務的事件會以接近即時的方式傳送到 EventBridge。您可撰寫簡單的規則，指出您在意的事件，以及當事件符合規則時所要自動執行的動作。EventBridge 至少發佈一次。如需詳細資訊，請參閱[建立對 EventBridge 中的事件做出反應的規則](https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/Create-CloudWatch-Events-Rule.html)。

CloudWatch Events 會使用 EventBridge 轉換為動作。使用 EventBridge，您可以使用事件來觸發目標。如需詳細資訊，請參閱[什麼是 Amazon EventBridge？](https://docs.aws.amazon.com/eventbridge/latest/userguide/what-is-amazon-eventbridge.html)

## Connector for SCEP 事件類型
<a name="c4scep-eventbridge-events"></a>

### 憑證發行成功
<a name="c4scep-ev-event-certificate-issuance-succeeded"></a>

當我們發出憑證以回應`PkiOperationPost`請求時，Connector for SCEP 會將`Certificate Issuance Succeeded`事件傳送至 EventBridge。

以下是事件的範例資料。

```
{
   "version": "0",
   "id": "event_ID",
   "detail-type": "Certificate Issuance Succeeded",
   "source": "aws.pca-connector-scep",
   "account": "account",
   "time": "2024-09-12T19:14:56Z",
   "region": "region",
   "resources":[
       "arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566",
       "arn:aws:pca-connector-scep:us-east-1:111122223333:connector/11223344-1234-1122-2233-112233445566"
   ],
   "detail": {
       "result": "success",
       "requestType": "PkiOperationPost",
       "certificateArn": "arn:aws:acm-pca:region:account:certificate-authority/CA_ID/certificate/certificate_ID"
   }
}
```

### 憑證發行失敗
<a name="c4scep-ev-event-certificate-issuance-failed"></a>

當我們無法發出憑證以回應`PkiOperationPost`請求時，Connector for SCEP 會將`Certificate Issuance Failed`事件傳送至 EventBridge。

以下是事件的範例資料。

```
{
   "version": "0",
   "id": "event_ID",
   "detail-type": "Certificate Issuance Failed",
   "source": "aws.pca-connector-scep",
   "account": "account",
   "time": "2024-09-12T19:14:56Z",
   "region": "region",
   "resources":[
       "arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566",
       "arn:aws:pca-connector-scep:us-east-1:111122223333:connector/11223344-1234-1122-2233-112233445566"
   ],
   "detail": {
       "result": "failure",
       "requestType": "PkiOperationPost",
       "reason": "The certificate authority is not active."
   }
}
```

### 憑證授權單位憑證擷取成功
<a name="c4scep-ev-event-ca-cert-retrieval-succeeded"></a>

當我們收到`GetCACert`請求並成功擷取連接器的私有 CA 憑證時，Connector for SCEP 會將`Certificate Authority Certificate Retrieval Succeeded`事件傳送至 EventBridge。

以下是事件的範例資料。

```
{
   "version": "0",
   "id": "event_ID",
   "detail-type": "Certificate Authority Certificate Retrieval Succeeded",
   "source": "aws.pca-connector-scep",
   "account": "account",
   "time": "2024-09-12T19:14:56Z",
   "region": "region",
   "resources":[
       "arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566",
       "arn:aws:pca-connector-scep:us-east-1:111122223333:connector/11223344-1234-1122-2233-112233445566"
   ],
   "detail": {
       "result": "success",
       "requestType": "GetCACert"
   }
}
```

### 憑證授權單位憑證擷取失敗
<a name="c4scep-ev-event-ca-cert-retrieval-failed"></a>

當我們收到`GetCACert`請求且無法擷取連接器的私有 CA 憑證時，Connector for SCEP 會將`Certificate Authority Certificate Retrieval Failed`事件傳送至 EventBridge。事件包含失敗的原因。

以下是事件的範例資料。

```
{
   "version": "0",
   "id": "event_ID",
   "detail-type": "Certificate Authority Certificate Retrieval Failed",
   "source": "aws.pca-connector-scep",
   "account": "account",
   "time": "2024-09-12T19:14:56Z",
   "region": "region",
   "resources":[
       "arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566",
       "arn:aws:pca-connector-scep:us-east-1:111122223333:connector/11223344-1234-1122-2233-112233445566"
   ],
   "detail": {
       "result": "failure",
       "requestType": "GetCACert",
       "reason": "The certificate authority certificate validity must be at least one year from today."
   }
}
```

### 憑證授權單位憑證擷取成功
<a name="c4scep-ev-event-ca-cert-retrieval-succeeded"></a>

當我們收到`GetCACert`請求並成功擷取連接器的私有 CA 憑證時，Connector for SCEP 會將`Certificate Authority Certificate Retrieval Succeeded`事件傳送至 EventBridge。

以下是事件的範例資料。

```
{
   "version": "0",
   "id": "event_ID",
   "detail-type": "Certificate Authority Certificate Retrieval Succeeded",
   "source": "aws.pca-connector-scep",
   "account": "account",
   "time": "2024-09-12T19:14:56Z",
   "region": "region",
   "resources":[
       "arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566",
       "arn:aws:pca-connector-scep:us-east-1:111122223333:connector/11223344-1234-1122-2233-112233445566"
   ],
   "detail": {
       "result": "success",
       "requestType": "GetCACert"
   }
}
```

### 憑證授權單位功能擷取成功
<a name="c4scep-ev-event-ca-capabilities-succeeded"></a>

當我們收到 SCEP `GetCACaps`請求並成功擷取 CA 的功能時，Connector for SCEP 會將`Certificate Authority Capabilities Retrieval Succeeded`事件傳送至 EventBridge。

以下是事件的範例資料。

```
```

### 憑證授權機構功能擷取失敗
<a name="c4scep-ev-event-ca-capabilities-failed"></a>

當我們收到 SCEP `GetCACaps`請求且無法擷取 CA 的功能時，Connector for SCEP 會將`Certificate Authority Capabilities Retrieval Failed`事件傳送至 EventBridge。我們在事件中包含失敗的原因。

以下是事件的範例資料。

```
{                                 
 "resources":
     [
     "arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566",
     "arn:aws:pca-connector-scep:us-east-1:111122223333:connector11223344-1234-1122-2233-112233445566"
     ],
 "detailType":"Certificate Authority Capabilities Retrieval Failed",
 "detail": {
     "result":"failure",
     "requestType":"GetCACaps",
     "reason":"The request was denied due to request throttling."
 },
 "source":"aws.pca-connector-scep","accountId":"111122223333"
 }
```

### 叫用不支援的操作
<a name="c4scep-ev-event-unsupported-operation"></a>

**叫用不支援的操作**  
如果傳送至連接器端點的操作不受支援或未知，Connector for SCEP 會將`Unsupported Operation Invoked`事件傳送至 EventBridge。

```
{
   "version": "0",
   "id": "event_ID",
   "detail-type": "Unsupported Operation Invoked",
   "source": "aws.pca-connector-scep",
   "account": "account",
   "time": "2024-09-12T19:14:56Z",
   "region": "region",
   "resources":[
       "arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/11223344-1234-1122-2233-112233445566",
       "arn:aws:pca-connector-scep:us-east-1:111122223333:connector/11223344-1234-1122-2233-112233445566"
   ],
   "detail": {}
}
```

## 建立 EventBridge 規則
<a name="c4scep-cwe-example-rule"></a>

在 EventBridge 中，您可以建立回應 CloudTrail 記錄之事件的規則。若要建立包含 Connector for SCEP 記錄的所有事件的規則，請將來源設定為 `aws.pca-connector-scep`。如需規則的詳細資訊，請參閱[在 Amazon EventBridge 中建立規則](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-get-started.html#eb-gs-create-rule)。

# 使用 的 Log Connector for SCEP API 呼叫 AWS CloudTrail
<a name="logging-using-cloudtrail-c4scep"></a>

Connector for Simple Certificate Enrollment Protocol (SCEP) 已與 服務整合 AWS CloudTrail，此服務可提供使用者、角色、用戶端或 AWS 服務所採取動作的記錄。CloudTrail 會將 Connector for SCEP 的所有 API 呼叫擷取為事件。擷取的呼叫包括來自 Connector for SCEP 主控台的呼叫，以及對 Connector for SCEP API 操作的程式碼呼叫。如果您建立線索，則可以將 CloudTrail 事件持續交付至 Amazon S3 儲存貯體，包括 Connector for SCEP 的事件。即使您未設定追蹤，依然可以透過 CloudTrail 主控台中的**事件歷史記錄**檢視最新事件。您可以使用 CloudTrail 所收集的資訊，判斷對 Connector for SCEP 提出的請求、提出請求的 IP 地址、提出請求的人員、提出請求的時間，以及其他詳細資訊。

若要進一步了解 CloudTrail，請參閱[「AWS CloudTrail 使用者指南」](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html)。

## CloudTrail 中 SCEP 資訊的連接器
<a name="c4scep-service-name-info-in-cloudtrail"></a>

當您建立帳戶 AWS 帳戶 時，您的 上會啟用 CloudTrail。在 Connector for SCEP 中發生活動時，該活動會與**事件歷史記錄**中的其他 AWS 服務事件一起記錄在 CloudTrail 事件中。您可以在 中檢視、搜尋和下載最近的事件 AWS 帳戶。如需詳細資訊，請參閱[「使用 CloudTrail 事件歷史記錄檢視事件」](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events.html)。

如需持續記錄 中的事件 AWS 帳戶，包括 Connector for SCEP 的事件，請建立追蹤。*線索*能讓 CloudTrail 將日誌檔案交付至 Amazon S3 儲存貯體。依預設，當您在主控台中建立追蹤時，該追蹤會套用至所有的 AWS 區域。線索會記錄 AWS 分割區中所有區域的事件，並將日誌檔案傳送到您指定的 Amazon S3 儲存貯體。此外，您可以設定其他 AWS 服務，以進一步分析和處理 CloudTrail 日誌中所收集的事件資料。如需詳細資訊，請參閱下列內容：
+ [建立追蹤的概觀](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html)
+ [CloudTrail 支援的服務和整合](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-aws-service-specific-topics.html)
+ [設定 CloudTrail 的 Amazon SNS 通知](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/configure-sns-notifications-for-cloudtrail.html)
+ [接收多個區域的 CloudTrail 日誌檔案](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/receive-cloudtrail-log-files-from-multiple-regions.html)和[接收多個帳戶的 CloudTrail 日誌檔案](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-receive-logs-from-multiple-accounts.html)

CloudTrail 會記錄所有 Connector for SCEP 動作，並記錄在 [Connector for SCEP API 參考](https://docs.aws.amazon.com/pca-connector-scep/latest/APIReference/Welcome.html)中。例如，對 `CreateConnector`、`GetConnector` 和 `CreateChallenge` 動作發出的呼叫會在 CloudTrail 記錄檔案中產生專案。

每一筆事件或日誌專案都會包含產生請求者的資訊。身分資訊可協助您判斷下列事項：
+ 是否使用根或 AWS Identity and Access Management (IAM) 使用者登入資料提出請求。
+ 提出該請求時，是否使用了特定角色或聯合身分使用者的暫時安全憑證。
+ 請求是否由其他 AWS 服務提出。
+ 請求是否由 SCEP 用戶端裝置提出。

如需詳細資訊，請參閱 [CloudTrail userIdentity 元素](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-user-identity.html)。

## 適用於 SCEP 管理事件的 連接器
<a name="c4scep-management-events"></a>

Connector for SCEP 與 CloudTrail 整合，以記錄使用者、角色或服務在 Connector for SCEP AWS 中所做的 API 動作。您可以使用 CloudTrail 即時監控 Connector for SCEP API 請求，並將日誌存放在 Amazon Simple Storage Service、Amazon CloudWatch Logs 和 Amazon CloudWatch Events 中。Connector for SCEP 支援將下列動作記錄為 CloudTrail 日誌檔案中的事件：
+ [CreateChallenge](https://docs.aws.amazon.com/pca-connector-scep/latest/APIReference/API_CreateChallenge.html)
+ [CreateConnector](https://docs.aws.amazon.com/pca-connector-scep/latest/APIReference/API_CreateConnector.html)
+ [GetConnector](https://docs.aws.amazon.com/pca-connector-scep/latest/APIReference/API_GetConnector.html)
+ [GetChallengeMetadata](https://docs.aws.amazon.com/pca-connector-scep/latest/APIReference/API_GetChallengeMetadata.html)
+ [GetChallengePassword](https://docs.aws.amazon.com/pca-connector-scep/latest/APIReference/API_GetChallengePassword.html)
+ [DeleteConnector](https://docs.aws.amazon.com/pca-connector-scep/latest/APIReference/API_DeleteConnector.html)
+ [DeleteChallenge](https://docs.aws.amazon.com/pca-connector-scep/latest/APIReference/API_DeleteChallenge.html)

## CloudTrail 中 SCEP 資料事件的連接器
<a name="c4scep-cloudtrail-data-events"></a>

[資料事件](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#logging-data-events)提供有關在資源上執行或在資源中執行的資源操作的資訊，例如，當您的用戶端傳送 SCEP `GetCACaps` 訊息到連接器端點時。這些也稱為資料平面操作。資料事件通常是大量資料的活動。根據預設，CloudTrail 不會記錄任何資料事件，CloudTrail **事件歷史記錄**也不會記錄這些資料事件。

資料事件需支付額外的費用。如需 CloudTrail 定價的詳細資訊，請參閱 [AWS CloudTrail 定價](https://aws.amazon.com/cloudtrail/pricing/)。

您可以使用 CloudTrail 主控台 AWS CLI或 CloudTrail API 操作來記錄`AWS::PCAConnectorSCEP::Connector`資源類型的資料事件。如需如何記錄資料事件的詳細資訊，請參閱 *AWS CloudTrail 使用者指南*中的[使用 AWS 管理主控台　記錄資料事件](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#logging-data-events-console)和[使用 AWS Command Line Interface記錄資料事件](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/logging-data-events-with-cloudtrail.html#creating-data-event-selectors-with-the-AWS-CLI)。

下表列出您可以記錄資料事件的 Connector for SCEP 資源類型。**資料事件類型 (主控台)** 資料行會顯示從 CloudTrail 主控台上的**資料事件類型**清單中選擇的值。**resources.type 值**欄會顯示值，您會在使用 AWS CLI 或 CloudTrail APIs 設定進階事件選取器時指定此`resources.type`值。**記錄到 CloudTrail 的資料 API** 資料行會針對資源類型顯示記錄到 CloudTrail 的 API 呼叫。


| 資料事件類型 (主控台) | resources.type 值 | 記錄到 CloudTrail 的資料 API | 
| --- | --- | --- | 
| 連接器 |  AWS::PCAConnectorSCEP::Connector  |  [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/zh_tw/privateca/latest/userguide/logging-using-cloudtrail-c4scep.html)  | 

您可以設定進階事件選取器來篩選 `eventName`、`readOnly` 和 `resources.ARN` 欄位，以僅記錄對您重要的事件。下列範例是資料事件組態的 JSON 檢視，該組態僅記錄特定函數的事件。如需有關這些欄位的詳細資訊，請參閱《AWS CloudTrail API 參考**》中的 [https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedFieldSelector.html](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/API_AdvancedFieldSelector.html)。

```
[
  {
    "name": "connector-scep-events",
    "fieldSelectors": [
      {
        "field": "eventCategory",
        "equals": [
          "Data"
        ]
      },
      {
        "field": "resources.type",
        "equals": [
          "AWS::PCAConnectorSCEP::Connector"
        ]
      },
      {
        "field": "resources.ARN",
        "equals": [
          "arn:aws:pca-connector-scep:US West (N. California):111122223333:connector/11223344-1122-2233-3344-cae95a00d2a7"
        ]
      }
    ]
  }
]
```

## 範例項目
<a name="c4scep-understanding-service-name-entries"></a>

追蹤是一種組態，能讓事件以日誌檔案的形式交付到您指定的 Amazon S3 儲存貯體。CloudTrail 日誌檔案包含一或多個日誌專案。一個事件為任何來源提出的單一請求，並包含請求動作、請求的日期和時間、請求參數等資訊。CloudTrail 日誌檔並非依公有 API 呼叫的堆疊追蹤排序，因此不會以任何特定順序出現。

**範例 1：管理事件、 `CreateConnector`**  
以下範例顯示的是展示 `CreateConnector` 動作的 CloudTrail 日誌項目。

```
{
        "eventVersion": "1.09",
        "userIdentity": {
          "type": "AssumedRole",
          "principalId": "AABB1122CCDD4455HHJJ1:11cc33nn2a97724dc48a89071111111111",
          "arn": "arn:aws:sts::111122223333:assumed-role/Admin",
          "accountId": "111122223333",
          "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
          "sessionContext": {
              "sessionIssuer": {
                  "type": "Role",
                  "principalId": "AABB1122CCDD4455HHJJ1",
                  "arn": "arn:aws:iam::111122223333:role/Admin",
                  "accountId": "111122223333",
                  "userName": "my-user-name"
              },
              "attributes": {
                  "creationDate": "2024-08-16T17:46:41Z",
                  "mfaAuthenticated": "false"
              }
          }
        },
        "eventTime": "2024-08-16T17:48:07Z",
        "eventSource": "pca-connector-scep.amazonaws.com",
        "eventName": "CreateConnector",
        "awsRegion": "us-east-1",
        "sourceIPAddress": "10.0.0.0",
        "userAgent": "Python/3.11.8 Darwin/22.6.0 exe/x86_64",
        "requestParameters": {
          "ClientToken": "11223344-2222-3333-4444-666555444555",
          "CertificateAuthorityArn": "arn:aws:acm-pca:us-east-1:111122223333:certificate-authority/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222"
        },
        "responseElements": {
          "ConnectorArn": "arn:aws:pca-connector-scep:us-east-1:111122223333:connector/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111"
        },
        "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLEaaaaa",
        "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLEbbbbb",
        "readOnly": false,
        "eventType": "AwsApiCall",
        "managementEvent": true,
        "recipientAccountId": "111122223333",
        "eventCategory": "Management"
        }
```

**範例 2：管理事件、 `CreateChallenge`**  
以下範例顯示的是展示 `CreateChallenge` 動作的 CloudTrail 日誌項目。

```
{
        "eventVersion": "1.09",
        "userIdentity": {
          "type": "AssumedRole",
          "principalId": "AABB1122CCDD4455HHJJ1:11cc33nn2a97724dc48a89071111111111",
          "arn": "arn:aws:sts::111122223333:assumed-role/Admin",
          "accountId": "111122223333",
          "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
          "sessionContext": {
              "sessionIssuer": {
                  "type": "Role",
                  "principalId": "AABB1122CCDD4455HHJJ1",
                  "arn": "arn:aws:iam::111122223333:role/Admin",
                  "accountId": "111122223333",
                  "userName": "user-name"
              },
              "attributes": {
                  "creationDate": "2024-08-16T17:46:41Z",
                  "mfaAuthenticated": "false"
              }
          }
        },
        "eventTime": "2024-08-16T17:47:52Z",
        "eventSource": "pca-connector-scep.amazonaws.com",
        "eventName": "CreateChallenge",
        "awsRegion": "us-east-1",
        "sourceIPAddress": "10.0.0.0",
        "userAgent": "Python/3.11.8 Darwin/22.6.0 exe/x86_64",
        "requestParameters": {
          "ConnectorArn": "arn:aws:pca-connector-scep:us-east-1:111122223333:connector/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
          "ClientToken": "11223344-2222-3333-4444-666555444555"
        },
        "responseElements": {
          "Challenge": {
              "Arn": "arn:aws:pca-connector-scep:us-east-1:111122223333:connector/9cac40bc-acba-412e-9a24-f255ef2fe79a/a1b2c3d4-5678-90ab-cdef-EXAMPLE22222",
              "ConnectorArn": "arn:aws:pca-connector-scep:us-east-1:111122223333:connector/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111",
              "CreatedAt": 1723830472.942,
              "Password": "***",
              "UpdatedAt": 1723830472.942
          }
        },
        "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLEaaaaa",
        "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLEbbbbb",
        "readOnly": false,
        "eventType": "AwsApiCall",
        "managementEvent": true,
        "recipientAccountId": "111122223333",
        "eventCategory": "Management"
        }
```

**範例 3：管理事件、 `GetChallengePassword`**  
以下範例顯示的是展示 `GetChallengePassword` 動作的 CloudTrail 日誌項目。

```
{
        "eventVersion": "1.09",
        "userIdentity": {
          "type": "AssumedRole",
          "principalId": "AABB1122CCDD4455HHJJ1:11cc33nn2a97724dc48a89071111111111",
          "arn": "arn:aws:sts::111122223333:assumed-role/Admin",
          "accountId": "111122223333",
          "accessKeyId": "ASIAIOSFODNN7EXAMPLE",
          "sessionContext": {
              "sessionIssuer": {
                  "type": "Role",
                  "principalId": "AABB1122CCDD4455HHJJ1",
                  "arn": "arn:aws:iam::111122223333:role/Admin",
                  "accountId": "905418114790",
                  "userName": "111122223333"
              },
              "attributes": {
                  "creationDate": "2024-08-16T17:55:01Z",
                  "mfaAuthenticated": "false"
              }
          },
          "invokedBy": "signin.amazonaws.com"
        },
        "eventTime": "2024-08-16T17:55:54Z",
        "eventSource": "pca-connector-scep.amazonaws.com",
        "eventName": "GetChallengePassword",
        "awsRegion": "us-east-1",
        "sourceIPAddress": "10.0.0.0",
        "userAgent": "Python/3.11.8 Darwin/22.6.0 exe/x86_64",
        "requestParameters": {
          "ChallengeArn": "arn:aws:pca-connector-scep:us-east-1:111122223333:challenge/a1b2c3d4-5678-90ab-cdef-EXAMPLE33333"
        },
        "responseElements": null,
        "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLEaaaaa",
        "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLEbbbbb",
        "readOnly": true,
        "eventType": "AwsApiCall",
        "managementEvent": true,
        "recipientAccountId": "111122223333",
        "eventCategory": "Management"
        }
```

**範例 4：資料事件、 `PkiOperationPost`**  
下列範例顯示示範失敗`PkiOperationPost`呼叫的 CloudTrail 日誌項目。日誌包含錯誤代碼和錯誤訊息，以及失敗的說明。

```
{
        "eventVersion": "1.10",
        "userIdentity": {
          "type": "FederatedUser",
          "principalId": "111122223333",
          "accountId": "111122223333"
        },
        "eventTime": "2024-08-16T17:40:09Z",
        "eventSource": "pca-connector-scep.amazonaws.com",
        "eventName": "PkiOperationPost",
        "awsRegion": "us-east-1",
        "sourceIPAddress": "10.0.0.0",
        "userAgent": "Python/3.11.8 Darwin/22.6.0 exe/x86_64",
        "errorCode": "BadRequestException",
        "errorMessage": "The certificate authority is not in a valid state for issuing certificates (Service: AcmPca, Status Code: 400, Request ID: a1b2c3d4-5678-90ab-cdef-EXAMPLE55555)",
        "requestParameters": null,
        "responseElements": null,
        "requestID": "a1b2c3d4-5678-90ab-cdef-EXAMPLEaaaaa",
        "eventID": "a1b2c3d4-5678-90ab-cdef-EXAMPLEbbbbb",
        "readOnly": false,
        "resources": [
          {
              "accountId": "111122223333",
              "type": "AWS::PCAConnectorSCEP::Connector",
              "ARN": "arn:aws:pca-connector-scep:us-east-1:111122223333:connector/a1b2c3d4-5678-90ab-cdef-EXAMPLE33333"
          }
        ],
        "eventType": "AwsApiCall",
        "managementEvent": false,
        "recipientAccountId": "905418114790",
        "eventCategory": "Data",
        "tlsDetails": {
          "clientProvidedHostHeader": "111122223333-a1b2c3d4-5678-90ab-cdef-EXAMPLE33333.enroll.pca-connector-scep.us-east-1.api.aws"
        }
        }
```