Live:CloudOps Webinars & Hands-on Workshops ·Register ↗
跳到主要内容

EventBridge 与 JITNA 的集成

使用即时节点访问 (JITNA) 时，当创建需要手动批准的会话访问请求时，会向 EventBridge 发出三种类型的事件：

  1. 请求者访问请求状态更新
  2. 审批者访问请求状态更新
  3. JITNA 访问请求失败
信息

基于自动审批策略自动批准的访问请求不会发出事件。

示例事件详情​

请求者访问请求事件​

以下是 Requester Access Request Status Update 事件的事件详情示例。

{
    "version": "0",
    "id": "6cfc3d6d-fd93-29e2-e96c-909a080ce519",
    "detail-type": "Requester Access Request Status Update",
    "source": "aws.ssm",
    "account": "123456789012",
    "time": "2025-04-10T20:19:32Z",
    "region": "us-east-2",
    "resources": ["arn:aws:ssm:us-east-2:123456789012:automation-execution/0aa5a695-4685-449f-90cc-49d24139dbe9"],
    "detail": {
        "ExecutionId": "0aa5a695-4685-449f-90cc-49d24139dbe9",
        "OpsItemId": "oi-f57e817742bd",
        "StartTime": "Apr 10, 2025, 8:19:30 PM",
        "TargetResourceArn": "arn:aws:ec2:us-east-2:123456789012:instance/i-0b3952fba006f5f0d",
        "Title": "Access Request - 2025-04-10 20:19 UTC",
        "Requester": "e1fbc510-8081-70c2-448f-123456789012",
        "AccessRequestStatus": "PendingApproval"
    }
}

审批者访问请求事件​

以下是 Approver Access Request Status Update 事件的事件详情示例。

{
    "version": "0",
    "id": "5d6ee943-9c8f-62aa-ee19-84391b0dc60a",
    "detail-type": "Approver Access Request Status Update",
    "source": "aws.ssm",
    "account": "123456789012",
    "time": "2025-04-10T20:19:30Z",
    "region": "us-east-2",
    "resources": ["arn:aws:ssm:us-east-2:123456789012:automation-execution/0aa5a695-4685-449f-90cc-49d24139dbe9"],
    "detail": {
        "ExecutionId": "0aa5a695-4685-449f-90cc-49d24139dbe9",
        "OpsItemId": "oi-f57e817742bd",
        "StartTime": "Apr 10, 2025, 8:19:29 PM",
        "Requester": "e1fbc510-8081-70c2-448f-123456789012",
        "Title": "Access Request - 2025-04-10 20:19 UTC",
        "TargetResourceArn": "arn:aws:ec2:us-east-2:123456789012:instance/i-0b3952fba006f5f0d",
        "AccessRequestApprovalLevelStatus": "PendingApproval",
        "StepName": "ManualApproval",
        "RequestReason": "Requesting access to node - production",
        "Approvers": ["816b5550-f031-70c9-4d41-123456789012", "d1db5560-10e1-7090-5614-123456789012"]
    }
}

JITNA 访问请求失败​

{
    "version": "0",
    "id": "aa09fe20-2b39-c973-42a0-edfa7eb85200",
    "detail-type": "JITNA Access Request Failed",
    "source": "aws.ssm",
    "account": "123456789012",
    "time": "2025-04-11T14:14:02Z",
    "region": "us-east-2",
    "resources": ["arn:aws:ssm:us-east-2:123456789012:opsitem/oi-fdac6036584a"],
    "detail": {
        "ApplicablePolicies": ["Approval-Policy-Production-Nodes", "prod"],
        "TargetResourceArn": "arn:aws:ec2:us-east-2:123456789012:instance/i-05d8934df93bb43db",
        "OpsItemId": "oi-fdac6036584a",
        "CreatedDate": "Fri Apr 11 14:13:58 UTC 2025",
        "Requester": "e1fbc510-8081-70c2-448f-123456789012"
    }
}

示例 OpsItem 详情​

即时节点访问请求存储为 Systems Manager OpsItem 资源。以下是一个由自动审批策略自动批准的会话访问请求的 OpsItem 详情示例。

{
    "OpsItem": {
        "CreatedBy": "arn:aws:sts::123456789012:assumed-role/AWSReservedSSO_jitna-operator_434098e0f9f1965d/bob@example.com",
        "OpsItemType": "/aws/accessrequest",
        "CreatedTime": "2025-05-02T14:57:14.118000+00:00",
        "Description": "OpsItem created for AccessRequest J8eDlHbgoAMEebw=.",
        "LastModifiedBy": "arn:aws:sts::123456789012:assumed-role/AWSServiceRoleForSystemsManagerJustInTimeAccess/JustInTimeAccessService",
        "LastModifiedTime": "2025-05-02T14:57:16.160000+00:00",
        "Notifications": [],
        "RelatedOpsItems": [],
        "Status": "Approved",
        "OpsItemId": "oi-a71f4d891d72",
        "Version": "1746197836160",
        "Title": "Access Request - 2025-05-02 14:57 UTC",
        "Source": "aws.ssm",
        "OperationalData": {
            "/aws/accessrequest/approvaldetails": {
                "Value": "Requesting access to node",
                "Type": "SearchableString"
            },
            "/aws/accessrequest/context": {
                "Value": "{\"targets\":{\"instanceId\":\"arn:aws:ec2:us-east-2:123456789012:instance/i-02999bd501754105a\"},\"accessTokenRole\":\"SSM-JustInTimeAccessTokenRole\"}",
                "Type": "SearchableString"
            },
            "/aws/accessrequest/accessduration": {
                "Value": "PT3600S",
                "Type": "SearchableString"
            },
            "/aws/accessrequest/endtime": {
                "Value": "2025-05-02 15:57:16 UTC",
                "Type": "SearchableString"
            },
            "/aws/accessrequest": {
                "Value": "{\"requester\":{\"isReplica\":\"false\",\"sourceOpsItemId\":\"oi-a71f4d891d72\",\"sourceAccountId\":\"\",\"id\":\"\",\"sourceRegion\":\"\",\"arn\":\"arn:aws:sts::123456789012:assumed-role/AWSReservedSSO_jitna-operator_434098e0f9f1965d/bob@example.com\"},\"approvalPolicy\":\"SSM-JustInTimeAccessAutoApprovalPolicy\",\"approvalPolicyVersion\":\"1\",\"automationExecutionId\":\"\"}",
                "Type": "SearchableString"
            },
            "/aws/accessrequest/starttime": {
                "Value": "2025-05-02 14:57:16 UTC",
                "Type": "SearchableString"
            }
        },
        "OpsItemArn": "arn:aws:ssm:us-east-2:123456789012:opsitem/oi-a71f4d891d72"
    }
}

EventBridge 规则模式​

{
  "source": ["aws.ssm"],
  "detail-type": ["Requester Access Request Status Update"]
}