Amazon CloudTrail

s3backup_cloudtrail.sh

#
# https://github.com/xme/toolbox/blob/master/getawslog.py
#
# */5 * * * * aws ~aws/bin/s3backup_cloudtrail.sh /var/log/aws_backup.log
#

#!/bin/bash

trap control_c SIGINT

checkprocces()
{
RETVAL=$1
NAME=$2
if [ $RETVAL = 0 ];then
echo -e "\e[00;32m ${NAME} OK \e[00m"
else
echo "$NAME error"
echo -e "\e[00;31m ${NAME} ERROR \e[00m"
EX=1
fi
}

function getcontent()
{
REM=$1
LOC=$2
mkdir -p ${LOC}
echo "`date +%Y-%m-%d_%H:%M:%S` [DOWNLOAD] Processing S3 cloudtrail logs"
/usr/sbin/s3cmd --config /root/.s3cfg --force --recursive sync s3://${REMOTE} ${LOCAL}
RETVAL=$?
checkprocces ${RETVAL} "S3 log download"
echo "*****************************************************************************************"
}

control_c()
{
 echo -e "\e[00;31m \n*** Exiting ***\n S3 log backup failed \e[00m"
 exit ${EX}
}

REMOTE="/CloudTrail"
LOCAL=/storage/amazon-cloudtrail

# Get content
getcontent ${REMOTE} ${LOCAL}

# Convert for Beaver
/aws/bin/trail.py -d -D -b cloudtrail-avg -j -l /var/log/trail.log
RETVAL=$?
checkprocces ${RETVAL} "CloudTrail conversion failed"

exit ${EX}