AWS API Audit CloudTrail

CloudTrailTest

//package com.volume.hooks.s3;

import com.amazonaws.auth.ClasspathPropertiesFileCredentialsProvider;
import com.amazonaws.regions.Region;
import com.amazonaws.regions.Regions;
import com.amazonaws.services.s3.AmazonS3;
import com.amazonaws.services.s3.AmazonS3Client;
import com.amazonaws.services.s3.model.GetObjectRequest;
import com.amazonaws.services.s3.model.ListObjectsRequest;
import com.amazonaws.services.s3.model.ObjectListing;
import com.amazonaws.services.s3.model.S3Object;
import com.amazonaws.services.s3.model.S3ObjectSummary;
import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import java.io.BufferedReader;

import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.Reader;
import java.util.Iterator;
import java.util.zip.GZIPInputStream;

public class CloudTrailTest {

  public static AmazonS3 s3;
  public static Region usEast1;

  public static void main(String[] args) throws IOException, InterruptedException {
    while (true) {

      //Read credentials from AwsCredentials.properties
      s3 = new AmazonS3Client(new ClasspathPropertiesFileCredentialsProvider());
            
      //Set your AWS region
      usEast1 = Region.getRegion(Regions.US_EAST_1);
      s3.setRegion(usEast1);

      //Name of the S3 bucket containing CloudTrail JSON
      ObjectListing objectListing = s3.listObjects(new ListObjectsRequest()
        .withBucketName("vatraildata"));

      //Iterate through all objects in the CloudTrail bucket
      for (S3ObjectSummary objectSummary : objectListing.getObjectSummaries()) {
        System.out.println("Downloading an object:" + objectSummary.getKey());

        S3Object object = s3.getObject(new GetObjectRequest("vatraildata", objectSummary.getKey()));
        System.out.println("Content-Type: " + object.getObjectMetadata().getContentType());
      
        //If the object contains content, treat it as a file
        if (objectSummary.getSize() > 0) {
          displayTextInputStream(object.getObjectContent());
                    
          // Optional: Delete the file after it has been read.
          //s3.deleteObject("vatraildata", object.getKey());
        }

      }

    }

  }

  private static void displayTextInputStream(InputStream input) throws IOException {

    //All of the files are GZipped JSON
    GZIPInputStream gzipStream = new GZIPInputStream(input);
    Reader decoder = new InputStreamReader(gzipStream, "US-ASCII");
    BufferedReader reader = new BufferedReader(decoder);

    String json = "";
    while (true) {
      String line = reader.readLine();
      json += line;
      if (line == null) {
        break;
      }

    }

    // Use your favorite JSON parser and go to town!
    ObjectMapper m = new ObjectMapper();
    JsonNode rootNode = m.readTree(json);

    JsonNode records = rootNode.path("Records");
    Iterator recordItr = records.iterator();
    while (recordItr.hasNext()) {
      JsonNode node = (JsonNode) recordItr.next();
      JsonNode userIdentity = node.path("userIdentity");

      JsonNode accountIdNode = (JsonNode) userIdentity.path("accountId");
      System.out.println("accountId:" + accountIdNode.asText());

      JsonNode typeNode = (JsonNode) userIdentity.path("type");
      System.out.println("type:" + typeNode.asText());

      JsonNode principalNode = (JsonNode) userIdentity.path("principalId");
      System.out.println("principalId:" + principalNode.asText());

      JsonNode arnNode = (JsonNode) userIdentity.path("arn");
      System.out.println("arn:" + arnNode.asText());

      JsonNode accessKeyIdNode = (JsonNode) userIdentity.path("accessKeyId");
      System.out.println("accessKeyId:" + accessKeyIdNode.asText());

      JsonNode eventName = node.path("eventName");
      System.out.println("event:" + eventName.asText());

      JsonNode ip = node.path("sourceIPAddress");
      System.out.println("ip:" + ip.asText());

      JsonNode dateTime = node.path("eventTime");
      System.out.println("eventTime:" + dateTime.asText());

      System.out.println("----");
    }
    gzipStream.close();
    decoder.close();
    reader.close();
  }
}