| 1 |
efrain |
1 |
<?php
|
|
|
2 |
namespace Aws\CloudTrail;
|
|
|
3 |
|
|
|
4 |
use Aws\S3\S3Client;
|
|
|
5 |
|
|
|
6 |
/**
|
|
|
7 |
* This class provides an easy way to read log files generated by AWS
|
|
|
8 |
* CloudTrail.
|
|
|
9 |
*
|
|
|
10 |
* CloudTrail log files contain data about your AWS API calls and are stored in
|
|
|
11 |
* Amazon S3. The log files are gzipped and contain structured data in JSON
|
|
|
12 |
* format. This class will automatically ungzip and decode the data, and return
|
|
|
13 |
* the data as an array of log records
|
|
|
14 |
*/
|
|
|
15 |
class LogFileReader
|
|
|
16 |
{
|
|
|
17 |
/** @var S3Client S3 client used to perform GetObject operations */
|
|
|
18 |
private $s3Client;
|
|
|
19 |
|
|
|
20 |
/**
|
|
|
21 |
* @param S3Client $s3Client S3 client used to retrieve objects
|
|
|
22 |
*/
|
|
|
23 |
public function __construct(S3Client $s3Client)
|
|
|
24 |
{
|
|
|
25 |
$this->s3Client = $s3Client;
|
|
|
26 |
}
|
|
|
27 |
|
|
|
28 |
/**
|
|
|
29 |
* Downloads, unzips, and reads a CloudTrail log file from Amazon S3
|
|
|
30 |
*
|
|
|
31 |
* @param string $s3BucketName The bucket name of the log file in Amazon S3
|
|
|
32 |
* @param string $logFileKey The key of the log file in Amazon S3
|
|
|
33 |
*
|
|
|
34 |
* @return array
|
|
|
35 |
*/
|
|
|
36 |
public function read($s3BucketName, $logFileKey)
|
|
|
37 |
{
|
|
|
38 |
// Create a command for getting the log file object
|
|
|
39 |
$command = $this->s3Client->getCommand('GetObject', [
|
|
|
40 |
'Bucket' => (string) $s3BucketName,
|
|
|
41 |
'Key' => (string) $logFileKey,
|
|
|
42 |
'ResponseContentEncoding' => 'x-gzip'
|
|
|
43 |
]);
|
|
|
44 |
|
|
|
45 |
// Make sure gzip encoding header is sent and accepted in order to
|
|
|
46 |
// inflate the response data.
|
|
|
47 |
$command['@http']['headers']['Accept-Encoding'] = 'gzip';
|
|
|
48 |
|
|
|
49 |
// Get the JSON response data and extract the log records
|
|
|
50 |
$result = $this->s3Client->execute($command);
|
|
|
51 |
$logData = json_decode($result['Body'], true);
|
|
|
52 |
|
|
|
53 |
return isset($logData['Records']) ? $logData['Records'] : [];
|
|
|
54 |
}
|
|
|
55 |
}
|