Skip to content

Instantly share code, notes, and snippets.

@bradllj bradllj/CloudTrailTest
Last active Aug 29, 2015

Embed
What would you like to do?
AWS API Audit CloudTrail
//package com.volume.hooks.s3;
import com.amazonaws.auth.ClasspathPropertiesFileCredentialsProvider;
import com.amazonaws.regions.Region;
import com.amazonaws.regions.Regions;
import com.amazonaws.services.s3.AmazonS3;
import com.amazonaws.services.s3.AmazonS3Client;
import com.amazonaws.services.s3.model.GetObjectRequest;
import com.amazonaws.services.s3.model.ListObjectsRequest;
import com.amazonaws.services.s3.model.ObjectListing;
import com.amazonaws.services.s3.model.S3Object;
import com.amazonaws.services.s3.model.S3ObjectSummary;
import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.Reader;
import java.util.Iterator;
import java.util.zip.GZIPInputStream;
public class CloudTrailTest {
public static AmazonS3 s3;
public static Region usEast1;
public static void main(String[] args) throws IOException, InterruptedException {
while (true) {
//Read credentials from AwsCredentials.properties
s3 = new AmazonS3Client(new ClasspathPropertiesFileCredentialsProvider());
//Set your AWS region
usEast1 = Region.getRegion(Regions.US_EAST_1);
s3.setRegion(usEast1);
//Name of the S3 bucket containing CloudTrail JSON
ObjectListing objectListing = s3.listObjects(new ListObjectsRequest()
.withBucketName("vatraildata"));
//Iterate through all objects in the CloudTrail bucket
for (S3ObjectSummary objectSummary : objectListing.getObjectSummaries()) {
System.out.println("Downloading an object:" + objectSummary.getKey());
S3Object object = s3.getObject(new GetObjectRequest("vatraildata", objectSummary.getKey()));
System.out.println("Content-Type: " + object.getObjectMetadata().getContentType());
//If the object contains content, treat it as a file
if (objectSummary.getSize() > 0) {
displayTextInputStream(object.getObjectContent());
// Optional: Delete the file after it has been read.
//s3.deleteObject("vatraildata", object.getKey());
}
}
}
}
private static void displayTextInputStream(InputStream input) throws IOException {
//All of the files are GZipped JSON
GZIPInputStream gzipStream = new GZIPInputStream(input);
Reader decoder = new InputStreamReader(gzipStream, "US-ASCII");
BufferedReader reader = new BufferedReader(decoder);
String json = "";
while (true) {
String line = reader.readLine();
json += line;
if (line == null) {
break;
}
}
// Use your favorite JSON parser and go to town!
ObjectMapper m = new ObjectMapper();
JsonNode rootNode = m.readTree(json);
JsonNode records = rootNode.path("Records");
Iterator recordItr = records.iterator();
while (recordItr.hasNext()) {
JsonNode node = (JsonNode) recordItr.next();
JsonNode userIdentity = node.path("userIdentity");
JsonNode accountIdNode = (JsonNode) userIdentity.path("accountId");
System.out.println("accountId:" + accountIdNode.asText());
JsonNode typeNode = (JsonNode) userIdentity.path("type");
System.out.println("type:" + typeNode.asText());
JsonNode principalNode = (JsonNode) userIdentity.path("principalId");
System.out.println("principalId:" + principalNode.asText());
JsonNode arnNode = (JsonNode) userIdentity.path("arn");
System.out.println("arn:" + arnNode.asText());
JsonNode accessKeyIdNode = (JsonNode) userIdentity.path("accessKeyId");
System.out.println("accessKeyId:" + accessKeyIdNode.asText());
JsonNode eventName = node.path("eventName");
System.out.println("event:" + eventName.asText());
JsonNode ip = node.path("sourceIPAddress");
System.out.println("ip:" + ip.asText());
JsonNode dateTime = node.path("eventTime");
System.out.println("eventTime:" + dateTime.asText());
System.out.println("----");
}
gzipStream.close();
decoder.close();
reader.close();
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.