AWS的流日志

文章目录

一、aws如何观察vpc的日志？
二、aws观测其vpc的入口日志
三、具体配置
- 3.1、配置你的存储神器 S3
- 3.2、建立子网的流日志

一、aws如何观察vpc的日志？

排查问题的时候除了去抓包看具体的端口信息的时候，还可以根据其所在的vpc的子网信息来查看其流入的数据日志

二、aws观测其vpc的入口日志

  1、首先你去看vpc的日志这样想就错误了，因为你的思路被堵着了，因为这个范围太大了2、 因为vpc是有儿子的，所以看vpc范围太大了，你要看的就是vpc的儿子的日子，子网的日志3、子网的日志你怎么看呢？ 那就必不可少的要请出我们的神器 ---- S3.

三、具体配置

3.1、配置你的存储神器 S3

选择你要存储日志的存储桶，有则添加权限，无则新建存储桶再配置此权限


{"Version": "2012-10-17","Id": "AWSLogDeliveryWrite","Statement": [{"Sid": "AWSLogDeliveryAclCheck","Effect": "Allow","Principal": {"Service": "delivery.logs.amazonaws.com"},"Action": "s3:GetBucketAcl","Resource": "arn:aws:s3:::cmp2-radius",         # cmp2-radius是存储桶的名称"Condition": {"StringEquals": {"aws:SourceAccount": "206038195036"},"ArnLike": {"aws:SourceArn": "arn:aws:logs:eu-central-1:206038195036:*"   # 206038195036 是你账号id}}},{"Sid": "AWSLogDeliveryWrite","Effect": "Allow","Principal": {"Service": "delivery.logs.amazonaws.com"},"Action": "s3:PutObject","Resource": "arn:aws:s3:::cmp2-radius/AWSLogs/206038195036/*","Condition": {"StringEquals": {"aws:SourceAccount": "206038195036","s3:x-amz-acl": "bucket-owner-full-control"},"ArnLike": {"aws:SourceArn": "arn:aws:logs:eu-central-1:206038195036:*"}}}]
}