知道啓動EC2實例的系統的IP地址

Question

我正在使用AWS，最近我的賬戶信息（訪問密鑰/密鑰）已被泄露。他們開始了21個Ec2實例。有沒有辦法檢查從哪個IP地址AWS EC2實例啓動？

Answer 1

如果您已啓用CloudTrail，您可以查看此信息。該事件應該有「sourceIPAddress」。

EC2 Log Example：

{ 
    "Records": [{ 
     "eventVersion": "1.0", 
     "userIdentity": { 
      "type": "IAMUser", 
      "principalId": "EX_PRINCIPAL_ID", 
      "arn": "arn:aws:iam::123456789012:user/Alice", 
      "accessKeyId": "EXAMPLE_KEY_ID", 
      "accountId": "123456789012", 
      "userName": "Alice" 
     }, 
     "eventTime": "2014-03-06T21:22:54Z", 
     "eventSource": "ec2.amazonaws.com", 
     "eventName": "StartInstances", 
     "awsRegion": "us-west-2", 
     "sourceIPAddress": "205.251.233.176", 
     "userAgent": "ec2-api-tools 1.6.12.2",