如何用jq从AWS CloudTrail ConsoleLogin事件提取指定字段

需求 #

从CloudTrail返回的ConsoleLogin事件JSON结果中，提取mfaAuthenticated、eventSource和eventType三个字段的值。

原执行命令 #

aws cloudtrail --region us-east-1 lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin --start-time $(date -d "-60 minutes" +%s) --query 'Events[].CloudTrailEvent.attributes' --output text | jq

返回的JSON示例 #

{
  "eventVersion": "1.08",
  "userIdentity": {
    "type": "AssumedRole",
    "principalId": "XXXXXXXXXXXXXXXXX:dkboss",
    "arn": "XXXXXXXXXXXXXXXXXXXXXXXXX/dkboss",
    "accountId": "XXXXXXXXXXXXXXXX",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "XXXXXXXXXXXXXXXXXXXXXXXXXX",
        "arn": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
        "accountId": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
        "userName": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
      },
      "webIdFederationData": {},
      "attributes": {
        "creationDate": "2022-11-27T15:24:28Z",
        "mfaAuthenticated": "false"
      }
    }
  },
  "eventTime": "2022-11-27T15:24:29Z",
  "eventSource": "signin.amazonaws.com",
  "eventName": "ConsoleLogin",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "1.1.1.1",
  "userAgent": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "requestParameters": null,
  "responseElements": {
    "ConsoleLogin": "Success"
  },
  "additionalEventData": {
    "MobileVersion": "No",
    "MFAUsed": "No"
  },
  "eventID": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
  "readOnly": false,
  "eventType": "AwsConsoleSignIn",
  "managementEvent": true,
  "recipientAccountId": "XXXXXXXXXXXXXXXXXXXXXXX",
  "eventCategory": "Management",
  "tlsDetails": {
    "tlsVersion": "TLSv1.2",
    "cipherSuite": "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX",
    "clientProvidedHostHeader": "signin.aws.amazon.com"
  }
}

解决方案 #

方法1：直接通过AWS CLI的--query参数提取

修改原命令的查询参数，直接定位到目标字段，无需额外工具处理：

aws cloudtrail --region us-east-1 lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin \
  --start-time $(date -d "-60 minutes" +%s) \
  --query 'Events[].{mfaAuthenticated: CloudTrailEvent.userIdentity.sessionContext.attributes.mfaAuthenticated, eventSource: CloudTrailEvent.eventSource, eventType: CloudTrailEvent.eventType}' \
  --output json

执行后会直接输出仅包含三个目标字段的JSON结构。

方法2：用jq处理已有JSON输出

如果已经获取到完整的JSON结果，可以用jq命令筛选字段：

jq '{mfaAuthenticated: .userIdentity.sessionContext.attributes.mfaAuthenticated, eventSource: .eventSource, eventType: .eventType}'

输出示例：

{
  "mfaAuthenticated": "false",
  "eventSource": "signin.amazonaws.com",
  "eventType": "AwsConsoleSignIn"
}

内容的提问来源于stack exchange，提问作者danish