如何在 AWS ELB 日志中获取完整的 POST 正文？

Question

Currently, AWS ELB, both classic and application, do not log the body of POST requests. Neither does Cloudfront. Is it possible to get the full body of HTTP requests at this level above the instance?

Answer 1

You can inspect HTTP request contents via WAF, and block based on certain conditions. This occurs before the request reaches the application. See https://aws.amazon.com/about-aws/whats-new/2016/01/aws-waf-now-inspects-http-request-body-and-adds-size-constraint-condition/

Answer 2

You can't get access to full POST body in ELB logs, it's not really what the ELB logs are for. They are more around request counts and timings etc. Also, the body of a POST could contain all sorts of sensitive information - email, password, date of birth, address etc.

It's also fairly unusual that logs would contain this kind of information, it's generally captured by the request handling application.

If recording the request in your application isn't an option you could look at Traffic Mirroring - one of the use cases is content inspection. This will allow you to copy all traffic from the ELB ENI and send it to another application, eg a service running on an EC2 instance that writes the body to and S3 bucket.