如何知道谁使用AWS Serverless应用程序启动或停止了EC2实例

Question

We have developed an AWS Serverless Lambda application using dotnetcore to perform operations on EC2 Instances, say start or stop EC2 instance and integrated with Aws API Gateway.

serverless.template in dotnetcore application

"StartInstanceById" : {
  "Type" : "AWS::Serverless::Function",
  "Properties": {
    "Handler": "EC2_Monitoring_Serverless::EC2_Monitoring_Serverless.Functions::StartInstanceById",
    "Runtime": "dotnetcore2.1",
    "CodeUri": "",
    "MemorySize": 256,
    "Timeout": 30,
    "Role": "arn:aws:iam::2808xxxx1013:role/lamda_start_stop",
    "Policies": [ "AWSLambdaBasicExecutionRole" ],
    "Events": {
      "PutResource": {
        "Type": "Api",
        "Properties": {
          "Path": "/instances",
          "Method": "Get"
        }
      }
    }
  }
}

The above Lambda function is working fine for starting ec2 instance when I invoking the API gateway url.

For calling these API's, We have created Angular 6 application and provided authentication using Aws Cognito Userpools. So the cognito user logins into the website and gets all EC2 informations.

If the user wants to stop / start the EC2 instance, user will click on the particular button which invokes the relevant api gateway url of the lambda functions and It's working fine.

Now the question is who performed that action. After so much of research on stackoverflow and aws community forums for knowing who started or stopped the EC2 instances , I found Aws CloudTrail logs the information when user start or stopped the instance.

So I created a trail and I can see the logs in S3 buckets. But in every log I opened, I saw that the role "arn:aws:iam::2808xxxx1013:role/lamda_start_stop" is captured. I know this is because of the Lambda function. But I want to know who really stopped the instance.

Please advice how to capture user details!

Answer 1

The reason lambda execution role is getting printed in cloudtrail , is because it has initiated the process to stop the ec2 instance. Here the role is assumed (instead of actual user).

To print your actual user, you need to implement logs at your lambda, which will print logs to Cloudwatch . You can get the actual user or any other custom information from those logs.