Update nexus: fix conflicts and sync local changes
This commit is contained in:
Shen Wei
@@ -1,45 +1,45 @@
|
||||
---
|
||||
title: Cross-Account Monitoring
|
||||
type: concept
|
||||
tags: [AWS, Security, CloudOps, Multi-Account]
|
||||
date: 2025-10-24
|
||||
---
|
||||
|
||||
## Definition
|
||||
Cross-Account Monitoring（跨账户监控）是指在 AWS 多账户环境中，通过安全配置的跨账户访问机制，实现对分布在多个账户的资源、日志和指标的集中监控能力。是 AWS 多账户策略的核心运营支柱之一。
|
||||
|
||||
## Core Properties
|
||||
- **最小权限原则**：仅授予必要的跨账户读取权限
|
||||
- **集中可见性**：单一管理界面覆盖所有账户
|
||||
- **安全边界**：IAM 角色信任策略定义清晰的信任边界
|
||||
- **审计追踪**：所有跨账户访问均留下 CloudTrail 记录
|
||||
|
||||
## AWS Implementation Mechanisms
|
||||
- **AWS Organizations + SCPs**：通过 Service Control Policies 定义账户权限边界
|
||||
- **IAM Cross-Account Roles**：跨账户角色切换实现安全访问
|
||||
- **Amazon EventBridge**：事件驱动的跨账户事件转发（该方案的核心机制）
|
||||
- **AWS CloudWatch Cross-Account Observability**：CloudWatch 原生跨账户可观测性
|
||||
- **AWS Security Hub**：跨账户安全态势集中管理
|
||||
|
||||
## Related Concepts
|
||||
- [[AWS Organizations]]：提供多账户层级结构，是跨账户监控的基础设施
|
||||
- [[Multi-Account Deployment]]：跨账户监控支撑多账户部署的可观测性
|
||||
- [[Centralized Logging]]：集中日志是跨账户监控的数据基础
|
||||
- [[StackSets Deployment Visibility]]：StackSets 部署监控是跨账户监控的具体应用场景
|
||||
- [[Landing Zone Architecture]]：AWS Landing Zone 推荐架构中包含跨账户监控设计
|
||||
- [[DevSecOps]]：跨账户安全监控是 DevSecOps 的重要组成部分
|
||||
|
||||
## Architecture Patterns
|
||||
1. **Hub-and-Spoke**：管理账户作为中心（Hub），成员账户作为辐射（Spoke）
|
||||
2. **Event-Driven Fan-out**：通过 EventBridge 将事件从各账户汇聚到管理账户
|
||||
3. **Aggregated Dashboards**：Grafana/CloudWatch Dashboards 聚合多账户视图
|
||||
4. **Centralized Alerting**：告警规则在管理账户统一定义，跨账户触发
|
||||
|
||||
## AWS Context
|
||||
- AWS Organizations Management Account：管理账户，通常承载中心监控功能
|
||||
- AWS Organizations Member Accounts：成员账户，被监控的资源所在
|
||||
- Organizational Units (OUs)：组织单元，用于分组管理成员账户
|
||||
- Trusted Access：AWS StackSets 受信任访问，允许多账户协调操作
|
||||
- [[Cross-Account Monitoring]] ← enabled_by ← [[AWS Organizations]] Trusted Access
|
||||
- [[Cross-Account Monitoring]] ← uses ← [[Amazon EventBridge]] Custom Event Bus
|
||||
- [[Cross-Account Monitoring]] ← stores ← [[CloudWatch Logs (central-cloudformation-logs)]]
|
||||
---
|
||||
title: Cross-Account Monitoring
|
||||
type: concept
|
||||
tags: [AWS, Security, CloudOps, Multi-Account]
|
||||
date: 2025-10-24
|
||||
---
|
||||
|
||||
## Definition
|
||||
Cross-Account Monitoring（跨账户监控）是指在 AWS 多账户环境中，通过安全配置的跨账户访问机制，实现对分布在多个账户的资源、日志和指标的集中监控能力。是 AWS 多账户策略的核心运营支柱之一。
|
||||
|
||||
## Core Properties
|
||||
- **最小权限原则**：仅授予必要的跨账户读取权限
|
||||
- **集中可见性**：单一管理界面覆盖所有账户
|
||||
- **安全边界**：IAM 角色信任策略定义清晰的信任边界
|
||||
- **审计追踪**：所有跨账户访问均留下 CloudTrail 记录
|
||||
|
||||
## AWS Implementation Mechanisms
|
||||
- **AWS Organizations + SCPs**：通过 Service Control Policies 定义账户权限边界
|
||||
- **IAM Cross-Account Roles**：跨账户角色切换实现安全访问
|
||||
- **Amazon EventBridge**：事件驱动的跨账户事件转发（该方案的核心机制）
|
||||
- **AWS CloudWatch Cross-Account Observability**：CloudWatch 原生跨账户可观测性
|
||||
- **AWS Security Hub**：跨账户安全态势集中管理
|
||||
|
||||
## Related Concepts
|
||||
- [[AWS Organizations]]：提供多账户层级结构，是跨账户监控的基础设施
|
||||
- [[Multi-Account Deployment]]：跨账户监控支撑多账户部署的可观测性
|
||||
- [[Centralized Logging]]：集中日志是跨账户监控的数据基础
|
||||
- [[StackSets Deployment Visibility]]：StackSets 部署监控是跨账户监控的具体应用场景
|
||||
- [[Landing Zone Architecture]]：AWS Landing Zone 推荐架构中包含跨账户监控设计
|
||||
- [[DevSecOps]]：跨账户安全监控是 DevSecOps 的重要组成部分
|
||||
|
||||
## Architecture Patterns
|
||||
1. **Hub-and-Spoke**：管理账户作为中心（Hub），成员账户作为辐射（Spoke）
|
||||
2. **Event-Driven Fan-out**：通过 EventBridge 将事件从各账户汇聚到管理账户
|
||||
3. **Aggregated Dashboards**：Grafana/CloudWatch Dashboards 聚合多账户视图
|
||||
4. **Centralized Alerting**：告警规则在管理账户统一定义，跨账户触发
|
||||
|
||||
## AWS Context
|
||||
- AWS Organizations Management Account：管理账户，通常承载中心监控功能
|
||||
- AWS Organizations Member Accounts：成员账户，被监控的资源所在
|
||||
- Organizational Units (OUs)：组织单元，用于分组管理成员账户
|
||||
- Trusted Access：AWS StackSets 受信任访问，允许多账户协调操作
|
||||
- [[Cross-Account Monitoring]] ← enabled_by ← [[AWS Organizations]] Trusted Access
|
||||
- [[Cross-Account Monitoring]] ← uses ← [[Amazon EventBridge]] Custom Event Bus
|
||||
- [[Cross-Account Monitoring]] ← stores ← [[CloudWatch Logs (central-cloudformation-logs)]]
|
||||
|
||||
Reference in New Issue
Block a user