46 lines
2.6 KiB
Markdown
46 lines
2.6 KiB
Markdown
---
|
||
title: Cross-Account Monitoring
|
||
type: concept
|
||
tags: [AWS, Security, CloudOps, Multi-Account]
|
||
date: 2025-10-24
|
||
---
|
||
|
||
## Definition
|
||
Cross-Account Monitoring（跨账户监控）是指在 AWS 多账户环境中，通过安全配置的跨账户访问机制，实现对分布在多个账户的资源、日志和指标的集中监控能力。是 AWS 多账户策略的核心运营支柱之一。
|
||
|
||
## Core Properties
|
||
- **最小权限原则**：仅授予必要的跨账户读取权限
|
||
- **集中可见性**：单一管理界面覆盖所有账户
|
||
- **安全边界**：IAM 角色信任策略定义清晰的信任边界
|
||
- **审计追踪**：所有跨账户访问均留下 CloudTrail 记录
|
||
|
||
## AWS Implementation Mechanisms
|
||
- **AWS Organizations + SCPs**：通过 Service Control Policies 定义账户权限边界
|
||
- **IAM Cross-Account Roles**：跨账户角色切换实现安全访问
|
||
- **Amazon EventBridge**：事件驱动的跨账户事件转发（该方案的核心机制）
|
||
- **AWS CloudWatch Cross-Account Observability**：CloudWatch 原生跨账户可观测性
|
||
- **AWS Security Hub**：跨账户安全态势集中管理
|
||
|
||
## Related Concepts
|
||
- [[AWS Organizations]]：提供多账户层级结构，是跨账户监控的基础设施
|
||
- [[Multi-Account Deployment]]：跨账户监控支撑多账户部署的可观测性
|
||
- [[Centralized Logging]]：集中日志是跨账户监控的数据基础
|
||
- [[StackSets Deployment Visibility]]：StackSets 部署监控是跨账户监控的具体应用场景
|
||
- [[Landing Zone Architecture]]：AWS Landing Zone 推荐架构中包含跨账户监控设计
|
||
- [[DevSecOps]]：跨账户安全监控是 DevSecOps 的重要组成部分
|
||
|
||
## Architecture Patterns
|
||
1. **Hub-and-Spoke**：管理账户作为中心（Hub），成员账户作为辐射（Spoke）
|
||
2. **Event-Driven Fan-out**：通过 EventBridge 将事件从各账户汇聚到管理账户
|
||
3. **Aggregated Dashboards**：Grafana/CloudWatch Dashboards 聚合多账户视图
|
||
4. **Centralized Alerting**：告警规则在管理账户统一定义，跨账户触发
|
||
|
||
## AWS Context
|
||
- AWS Organizations Management Account：管理账户，通常承载中心监控功能
|
||
- AWS Organizations Member Accounts：成员账户，被监控的资源所在
|
||
- Organizational Units (OUs)：组织单元，用于分组管理成员账户
|
||
- Trusted Access：AWS StackSets 受信任访问，允许多账户协调操作
|
||
- [[Cross-Account Monitoring]] ← enabled_by ← [[AWS Organizations]] Trusted Access
|
||
- [[Cross-Account Monitoring]] ← uses ← [[Amazon EventBridge]] Custom Event Bus
|
||
- [[Cross-Account Monitoring]] ← stores ← [[CloudWatch Logs (central-cloudformation-logs)]]
|