CODEWITHSUNDEEP
amazon-web-servicesamazon-ec2
chairbender
chairbender

Reputation: 849

How can I determine the AWS account username of the user that last started an EC2 instance?

We have quite a lot of EC2 instances all being used for various projects. Sometimes, a developer leaves an instance on even though they aren't using it, which wastes money. We have alarms set up to check if an instance isn't being used, but we also want to be able to ask the developer who started the instance about it, without having to send out a mass email to all developers.

Is there some way to determine the AWS username of the user who last started an EC2 instance? Is there any way to get info on who started an instance?

Upvotes: 2

Views: 337

Answers (1)

Jim Flanagan
Jim Flanagan

Reputation: 2129

If you enable AWS CloudTrail, you can get detailed, machine-readable logs about which APIs were invoked by whom, and when. The logs are then placed in an S3 bucket on a periodic basis. Here's a sample EC2 StartInstances log entry:

{
    "Records": [{
        "eventVersion": "1.0",
        "userIdentity": {
            "type": "IAMUser",
            "principalId": "EX_PRINCIPAL_ID",
            "arn": "arn:aws:iam::123456789012:user/Alice",
            "accessKeyId": "EXAMPLE_KEY_ID",
            "accountId": "123456789012",
            "userName": "Alice"
        },
        "eventTime": "2014-03-06T21:22:54Z",
        "eventSource": "ec2.amazonaws.com",
        "eventName": "StartInstances",
        "awsRegion": "us-west-2",
        "sourceIPAddress": "205.251.233.176",
        "userAgent": "ec2-api-tools 1.6.12.2",
        "requestParameters": {
            "instancesSet": {
                 "items": [{
                      "instanceId": "i-ebeaf9e2"
                }]
            }
        },
        "responseElements": {
            "instancesSet": {
                "items": [{
                      "instanceId": "i-ebeaf9e2",
                      "currentState": {
                          "code": 0,
                          "name": "pending"
                      },
                      "previousState": {
                          "code": 80,
                          "name": "stopped"
                      }
                    }]
            }
        }
    },
    ... additional entries ...
    ]
}

Upvotes: 3

Related Questions