Skip to content

Commit 13b66b7

Browse files
mwunderlmwunderl
committed
Add management tutorials (batch 16)
1 parent 49f07d9 commit 13b66b7

15 files changed

Lines changed: 1299 additions & 0 deletions

File tree

‎tuts/094-aws-cloudtrail-gs/README.md‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
# CloudTrail: Enable logging and look up events
2+
3+
Create a CloudTrail trail that logs API activity to an S3 bucket, look up recent events, and clean up.
4+
5+
## Source
6+
7+
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-tutorial.html
8+
9+
## Use case
10+
11+
- ID: cloudtrail/getting-started
12+
- Phase: create
13+
- Complexity: beginner
14+
- Core actions: cloudtrail:CreateTrail, cloudtrail:StartLogging, cloudtrail:LookupEvents
15+
16+
## What it does
17+
18+
1. Creates an S3 bucket for trail logs
19+
2. Sets the bucket policy to allow CloudTrail writes
20+
3. Creates a trail pointing to the bucket
21+
4. Starts logging
22+
5. Looks up recent API events
23+
6. Describes the trail configuration
24+
25+
## Running
26+
27+
```bash
28+
bash aws-cloudtrail-gs.sh
29+
```
30+
31+
To auto-run with cleanup:
32+
33+
```bash
34+
echo 'y' | bash aws-cloudtrail-gs.sh
35+
```
36+
37+
## Resources created
38+
39+
- CloudTrail trail
40+
- S3 bucket (with CloudTrail bucket policy)
41+
42+
## Estimated time
43+
44+
- Run: ~10 seconds
45+
46+
## Cost
47+
48+
S3 storage only. CloudTrail delivers management event logs to S3 at no charge for the first trail. S3 storage costs apply for the log files.
49+
50+
## Related docs
51+
52+
- [Getting started with CloudTrail tutorials](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-tutorial.html)
53+
- [Creating a trail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html)
54+
- [Amazon S3 bucket policy for CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/create-s3-bucket-policy-for-cloudtrail.html)
55+
- [Looking up events with LookupEvents](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/view-cloudtrail-events-cli.html)
56+
- [CloudTrail pricing](https://aws.amazon.com/cloudtrail/pricing/)
57+
58+
---
59+
60+
## Appendix: Generation details
61+
62+
| Field | Value |
63+
|-------|-------|
64+
| Generation date | 2026-04-14 |
65+
| Script lines | 110 |
66+
| Script test result | EXIT 0, 10s, 6 steps, no issues |
67+
| Issues encountered | None |
68+
| Iterations | v1 |

‎tuts/094-aws-cloudtrail-gs/aws-cloudtrail-gs.md‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
# Enable CloudTrail logging and look up recent events
2+
3+
This tutorial shows you how to create an AWS CloudTrail trail that logs API activity to an S3 bucket, look up recent events, and clean up.
4+
5+
## Prerequisites
6+
7+
- AWS CLI configured with credentials and a default region
8+
- Permissions for `cloudtrail:CreateTrail`, `cloudtrail:StartLogging`, `cloudtrail:LookupEvents`, `cloudtrail:DescribeTrails`, `cloudtrail:DeleteTrail`, `s3:CreateBucket`, `s3:PutBucketPolicy`, `s3:DeleteBucket`
9+
10+
## Step 1: Create an S3 bucket for trail logs
11+
12+
CloudTrail delivers log files to an S3 bucket. Create a bucket with a unique name:
13+
14+
```bash
15+
BUCKET_NAME="cloudtrail-tut-$(openssl rand -hex 4)-$(aws sts get-caller-identity --query Account --output text)"
16+
17+
aws s3api create-bucket --bucket "$BUCKET_NAME" \
18+
--create-bucket-configuration LocationConstraint="$AWS_DEFAULT_REGION"
19+
```
20+
21+
For `us-east-1`, omit the `--create-bucket-configuration` parameter.
22+
23+
## Step 2: Set the bucket policy for CloudTrail
24+
25+
CloudTrail requires a bucket policy that grants it permission to check the bucket ACL and write log files:
26+
27+
```bash
28+
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
29+
30+
cat > bucket-policy.json << EOF
31+
{
32+
"Version": "2012-10-17",
33+
"Statement": [
34+
{
35+
"Sid": "AWSCloudTrailAclCheck",
36+
"Effect": "Allow",
37+
"Principal": {"Service": "cloudtrail.amazonaws.com"},
38+
"Action": "s3:GetBucketAcl",
39+
"Resource": "arn:aws:s3:::$BUCKET_NAME"
40+
},
41+
{
42+
"Sid": "AWSCloudTrailWrite",
43+
"Effect": "Allow",
44+
"Principal": {"Service": "cloudtrail.amazonaws.com"},
45+
"Action": "s3:PutObject",
46+
"Resource": "arn:aws:s3:::$BUCKET_NAME/AWSLogs/$ACCOUNT_ID/*",
47+
"Condition": {"StringEquals": {"s3:x-amz-acl": "bucket-owner-full-control"}}
48+
}
49+
]
50+
}
51+
EOF
52+
53+
aws s3api put-bucket-policy --bucket "$BUCKET_NAME" --policy file://bucket-policy.json
54+
```
55+
56+
The first statement lets CloudTrail verify bucket ownership. The second lets it write log files under the `AWSLogs/` prefix.
57+
58+
## Step 3: Create a trail
59+
60+
Create a trail that points to your S3 bucket:
61+
62+
```bash
63+
TRAIL_NAME="tutorial-trail-$(openssl rand -hex 4)"
64+
65+
aws cloudtrail create-trail --name "$TRAIL_NAME" --s3-bucket-name "$BUCKET_NAME" \
66+
--query '{Trail:Name,Bucket:S3BucketName}' --output table
67+
```
68+
69+
The trail is created but not yet logging. By default it records management events in all Regions.
70+
71+
## Step 4: Start logging
72+
73+
```bash
74+
aws cloudtrail start-logging --name "$TRAIL_NAME"
75+
```
76+
77+
CloudTrail begins recording API activity and delivering log files to the S3 bucket within about 15 minutes.
78+
79+
## Step 5: Look up recent events
80+
81+
Use `lookup-events` to search the last 10 minutes of API activity:
82+
83+
```bash
84+
START_TIME=$(date -u -d '10 minutes ago' +%Y-%m-%dT%H:%M:%SZ 2>/dev/null \
85+
|| date -u -v-10M +%Y-%m-%dT%H:%M:%SZ)
86+
87+
aws cloudtrail lookup-events \
88+
--start-time "$START_TIME" \
89+
--max-results 5 \
90+
--query 'Events[].{Time:EventTime,Name:EventName,User:Username}' --output table
91+
```
92+
93+
This returns events from the Event history, which is available regardless of whether a trail exists. The trail you created delivers the same events (plus more detail) to S3.
94+
95+
## Step 6: Describe the trail
96+
97+
```bash
98+
aws cloudtrail describe-trails --trail-name-list "$TRAIL_NAME" \
99+
--query 'trailList[0].{Name:Name,Bucket:S3BucketName,IsMultiRegion:IsMultiRegionTrail}' \
100+
--output table
101+
```
102+
103+
## Cleanup
104+
105+
Delete the trail, then empty and delete the S3 bucket:
106+
107+
```bash
108+
aws cloudtrail delete-trail --name "$TRAIL_NAME"
109+
aws s3 rm "s3://$BUCKET_NAME" --recursive --quiet
110+
aws s3 rb "s3://$BUCKET_NAME"
111+
```
112+
113+
The script automates all steps including cleanup. Run it with:
114+
115+
```bash
116+
bash aws-cloudtrail-gs.sh
117+
```

‎tuts/094-aws-cloudtrail-gs/aws-cloudtrail-gs.sh‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
#!/bin/bash
2+
# Tutorial: Enable CloudTrail logging and look up recent events
3+
# Source: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-tutorial.html
4+
5+
WORK_DIR=$(mktemp -d)
6+
LOG_FILE="$WORK_DIR/cloudtrail-$(date +%Y%m%d-%H%M%S).log"
7+
exec > >(tee -a "$LOG_FILE") 2>&1
8+
9+
REGION=${AWS_DEFAULT_REGION:-${AWS_REGION:-$(aws configure get region 2>/dev/null)}}
10+
if [ -z "$REGION" ]; then
11+
echo "ERROR: No AWS region configured. Set one with: export AWS_DEFAULT_REGION=us-east-1"
12+
exit 1
13+
fi
14+
export AWS_DEFAULT_REGION="$REGION"
15+
ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text)
16+
echo "Region: $REGION"
17+
echo "Account: $ACCOUNT_ID"
18+
19+
RANDOM_ID=$(openssl rand -hex 4)
20+
TRAIL_NAME="tutorial-trail-${RANDOM_ID}"
21+
BUCKET_NAME="cloudtrail-tut-${RANDOM_ID}-${ACCOUNT_ID}"
22+
23+
handle_error() { echo "ERROR on line $1"; trap - ERR; cleanup; exit 1; }
24+
trap 'handle_error $LINENO' ERR
25+
26+
cleanup() {
27+
echo ""
28+
echo "Cleaning up resources..."
29+
aws cloudtrail delete-trail --name "$TRAIL_NAME" 2>/dev/null && echo " Deleted trail $TRAIL_NAME"
30+
# Empty and delete the bucket
31+
if aws s3 ls "s3://$BUCKET_NAME" > /dev/null 2>&1; then
32+
aws s3 rm "s3://$BUCKET_NAME" --recursive --quiet 2>/dev/null
33+
aws s3 rb "s3://$BUCKET_NAME" 2>/dev/null && echo " Deleted bucket $BUCKET_NAME"
34+
fi
35+
rm -rf "$WORK_DIR"
36+
echo "Cleanup complete."
37+
}
38+
39+
# Step 1: Create S3 bucket for trail logs
40+
echo "Step 1: Creating S3 bucket for trail logs: $BUCKET_NAME"
41+
if [ "$REGION" = "us-east-1" ]; then
42+
aws s3api create-bucket --bucket "$BUCKET_NAME" > /dev/null
43+
else
44+
aws s3api create-bucket --bucket "$BUCKET_NAME" \
45+
--create-bucket-configuration LocationConstraint="$REGION" > /dev/null
46+
fi
47+
48+
# Step 2: Set bucket policy to allow CloudTrail writes
49+
echo "Step 2: Setting bucket policy for CloudTrail"
50+
cat > "$WORK_DIR/bucket-policy.json" << EOF
51+
{
52+
"Version": "2012-10-17",
53+
"Statement": [
54+
{
55+
"Sid": "AWSCloudTrailAclCheck",
56+
"Effect": "Allow",
57+
"Principal": {"Service": "cloudtrail.amazonaws.com"},
58+
"Action": "s3:GetBucketAcl",
59+
"Resource": "arn:aws:s3:::$BUCKET_NAME"
60+
},
61+
{
62+
"Sid": "AWSCloudTrailWrite",
63+
"Effect": "Allow",
64+
"Principal": {"Service": "cloudtrail.amazonaws.com"},
65+
"Action": "s3:PutObject",
66+
"Resource": "arn:aws:s3:::$BUCKET_NAME/AWSLogs/$ACCOUNT_ID/*",
67+
"Condition": {"StringEquals": {"s3:x-amz-acl": "bucket-owner-full-control"}}
68+
}
69+
]
70+
}
71+
EOF
72+
aws s3api put-bucket-policy --bucket "$BUCKET_NAME" --policy "file://$WORK_DIR/bucket-policy.json"
73+
echo " Bucket policy applied"
74+
75+
# Step 3: Create a trail
76+
echo "Step 3: Creating trail: $TRAIL_NAME"
77+
aws cloudtrail create-trail --name "$TRAIL_NAME" --s3-bucket-name "$BUCKET_NAME" \
78+
--query '{Trail:Name,Bucket:S3BucketName}' --output table
79+
80+
# Step 4: Start logging
81+
echo "Step 4: Starting logging"
82+
aws cloudtrail start-logging --name "$TRAIL_NAME"
83+
echo " Logging started"
84+
85+
# Step 5: Look up recent events
86+
echo "Step 5: Looking up recent API events (last 10 minutes)"
87+
START_TIME=$(date -u -d '10 minutes ago' +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -v-10M +%Y-%m-%dT%H:%M:%SZ)
88+
aws cloudtrail lookup-events \
89+
--start-time "$START_TIME" \
90+
--max-results 5 \
91+
--query 'Events[].{Time:EventTime,Name:EventName,User:Username}' --output table
92+
93+
# Step 6: Describe the trail
94+
echo "Step 6: Describing the trail"
95+
aws cloudtrail describe-trails --trail-name-list "$TRAIL_NAME" \
96+
--query 'trailList[0].{Name:Name,Bucket:S3BucketName,IsMultiRegion:IsMultiRegionTrail,IsLogging:HasCustomEventSelectors}' --output table
97+
98+
echo ""
99+
echo "Tutorial complete."
100+
echo "Do you want to clean up all resources? (y/n): "
101+
read -r CHOICE
102+
if [[ "$CHOICE" =~ ^[Yy]$ ]]; then
103+
cleanup
104+
else
105+
echo "Resources left running. The trail logs API activity to S3."
106+
echo "Manual cleanup:"
107+
echo " aws cloudtrail delete-trail --name $TRAIL_NAME"
108+
echo " aws s3 rm s3://$BUCKET_NAME --recursive"
109+
echo " aws s3 rb s3://$BUCKET_NAME"
110+
fi

‎tuts/099-amazon-cloudwatch-logs-gs/README.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
# CloudWatch Logs: Create log groups and query logs
2+
3+
## Source
4+
5+
https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html
6+
7+
## Use case
8+
9+
- **ID**: cloudwatch-logs/getting-started
10+
- **Level**: beginner
11+
- **Core actions**: `logs:CreateLogGroup`, `logs:PutLogEvents`, `logs:FilterLogEvents`, `logs:StartQuery`
12+
13+
## Steps
14+
15+
1. Create a log group
16+
2. Set retention to 7 days
17+
3. Create a log stream
18+
4. Put 5 log events (INFO/WARN/ERROR)
19+
5. Get log events
20+
6. Filter for ERROR and WARN
21+
7. Run a Logs Insights query
22+
23+
## Resources created
24+
25+
| Resource | Type |
26+
|----------|------|
27+
| `/tutorials/cloudwatch-logs-gs` | Log group |
28+
29+
## Cost
30+
31+
Negligible for 5 log events. All resources removed during cleanup.
32+
33+
## Duration
34+
35+
~14 seconds
36+
37+
## Related docs
38+
39+
- [What is Amazon CloudWatch Logs?](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html)
40+
- [CloudWatch Logs Insights query syntax](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/CWL_QuerySyntax.html)
41+
- [Filter and pattern syntax](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html)
42+
43+
---
44+
45+
## Appendix
46+
47+
| Field | Value |
48+
|-------|-------|
49+
| Date | 2026-04-14 |
50+
| Script lines | 91 |
51+
| Exit code | 0 |
52+
| Runtime | 14s |
53+
| Steps | 7 |
54+
| Issues | None |
55+
| Version | v1 |

0 commit comments

Comments
 (0)