编写Lambda boto3函数验证AWS CloudTrail等服务是否已创建启用

问题排查（CloudTrail报错原因） #

当前编写的CloudTrail验证代码报错通常由以下三类原因导致：

• Lambda执行角色缺少对应权限，没有调用cloudtrail:GetTrailStatus接口的授权
• 指定名称为Test的Trail资源不存在，或是在非当前boto3默认区域创建
• 未做异常捕获，接口调用失败时直接抛出运行时错误终止程序

修正后完整验证代码 #

覆盖CloudTrail、Macie、AWS Config三类服务的验证逻辑，加入异常捕获处理：

import boto3
from botocore.exceptions import ClientError

def lambda_handler(event, context):
    # 初始化校验结果
    check_result = {
        "CloudTrail": "未启用",
        "Macie": "未启用",
        "AWS Config": "未启用"
    }
    
    # 1. CloudTrail状态校验
    try:
        cloudtrail_client = boto3.client('cloudtrail')
        # 先列举所有Trail避免指定名称不存在的问题
        trails = cloudtrail_client.list_trails()['Trails']
        if trails:
            # 可修改为指定名称的Trail校验
            response = cloudtrail_client.get_trail_status(Name=trails[0]['TrailARN'])
            if response['IsLogging']:
                check_result['CloudTrail'] = "已启用"
    except ClientError as e:
        print(f"CloudTrail校验异常: {e.response['Error']['Message']}")
    
    # 2. Macie状态校验
    try:
        macie_client = boto3.client('macie2')
        response = macie_client.get_macie_session()
        if response['status'] == 'ENABLED':
            check_result['Macie'] = "已启用"
    except ClientError as e:
        print(f"Macie校验异常: {e.response['Error']['Message']}")
    
    # 3. AWS Config状态校验
    try:
        config_client = boto3.client('configservice')
        response = config_client.describe_configuration_recorder_status()
        if response['ConfigurationRecordersStatus']:
            if response['ConfigurationRecordersStatus'][0]['recording']:
                check_result['AWS Config'] = "已启用"
    except ClientError as e:
        print(f"AWS Config校验异常: {e.response['Error']['Message']}")
    
    print(check_result)
    return check_result

必要IAM权限配置 #

需要为Lambda执行角色添加以下权限策略：

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cloudtrail:ListTrails",
                "cloudtrail:GetTrailStatus",
                "macie2:GetMacieSession",
                "configservice:DescribeConfigurationRecorderStatus"
            ],
            "Resource": "*"
        }
    ]
}

内容的提问来源于stack exchange，提问作者Marquise Anderson