Subscribe to configuration changes in a multi-account environment

Use cases

In this scenario, a management account views configuration change events from other members (business account B and business account C) by using a dedicated member (log archive account A). This topic uses the configuration change events for RAM roles with the prefix sg- as an example.

Prerequisites

• The Resource Directory management account has added log archive account A, business account B, and business account C as members. For more information, see Create a member or Invite an Alibaba Cloud account to join a resource directory.

• Function Compute is activated. For more information, see Quickly create a function.

• EventBridge is activated. For more information, see Activate EventBridge and grant permissions.

Configuration plan

Workflow

Step 1: Create a RAM role in the log account

Log archive account A uses EventBridge cross-account event routing to deliver events from business account B and business account C to its own event bus, providing a centralized view of configuration changes.

First, create a RAM role (for example, account-eb-role) in log archive account A for cross-account event delivery. The EventBridge services in business accounts assume this role to deliver events to log archive account A.

1. Create a RAM role and grant it permissions.

   1. Log on to the RAM console.

   2. In the left-side navigation pane, choose Identities > Roles.

   3. On the Roles page, click Create Role.

   4. For Principal Type, select Account. Leave Principal Name as the default (current cloud account), and then click Confirm.

   5. Click Confirm. On the Create Role page, enter account-eb-role for Role Name to complete the role creation.

   6. Click Grant Permission. On the Policies tab of the Grant Permission panel, search for and select the AliyunEventBridgePutEventsPolicy permission policy, leave the other parameters as their defaults, and click OK.

2. Modify the trust policy.

   1. On the Roles page, click the name of the RAM role you created.

   2. Click the Trust Policy tab, and then click Edit Trust Policy.

   3. Modify the trust policy content.

      The trust policy allows the EventBridge services of business account B and business account C to assume this RAM role. Sample trust policy:

      {
          "Statement":[
              {
                  "Action":"sts:AssumeRole",
                  "Effect":"Allow",
                  "Principal":{
                      "Service":[
                          "<ID of business account B>@eventbridge.aliyuncs.com",
                          "<ID of business account C>@eventbridge.aliyuncs.com"
                      ]
                  }
              }
          ],
          "Version":"1"
      }

   4. Click OK to save the trust policy.

Step 2: Configure event buses in business accounts

Create an event rule named b-eb-filter-ram-role in business account B and another named c-eb-filter-ram-role in business account C. These rules route configuration change events to EventBridge in log archive account A through the account-eb-role role.

1. Log on to the EventBridge console.

2. In the left-side navigation pane, click Event Buses.

3. In the top navigation bar, select a region. For example, select China (Shanghai).

4. On the Event Buses page, find the System Event Bus event bus and click Create Rule.

5. On the Create Rule page, configure the parameters for the event rule.

   1. On the Configure Basic Info page, enter a name for the rule and click Next Step.

   2. On the Configure Event Pattern page, set Event Source Type to Alibaba Cloud Service Event Source, Event Source to acs.ram, and Event Type to ram:Config:ConfigurationItemChangeNotification (RAM configuration change notification). In the Pattern Content editor, enter the following code, and then click Next Step.

      This event pattern ensures that EventBridge captures events only when a configuration change occurs for a RAM resource (role or user) whose name starts with sg-.

      {
          "source": [
              "acs.ram"
          ],
          "data": {
              "resourceName": [
                  {
                      "prefix": "sg-"
                  }
              ]
          },
          "type": [
              "ram:Config:ConfigurationItemChangeNotification"
          ]
      }

   3. On the Configure Targets page, set Service Type to EventBridge and Destination Type to Cross-account Event Bus. Select the Region of the target bus, enter the ID of log archive account A for Account ID, enter default for Event Bus Name, enter account-eb-role for Role, and select Complete Event for Event. Then, click Create.

Step 3: Configure Function Compute in the log account

In log archive account A, create a function in Function Compute and configure a trigger to deliver configuration change events to the function.

1. Create a service.

   1. Log on to the Function Compute console.

   2. In the left-side navigation pane, click Service and Function.

   3. In the top navigation bar, select a region, such as China (Shanghai).

   4. On the Services page, click Create Service.

   5. In the Create Service panel, for Name, enter eb_event_action.

   6. Click OK.

2. Create a function.

   1. On the Function Management page of the eb_event_action service, click Create Function.

   2. On the Create Function page, configure the basic settings and a trigger.

      • In the Basic Information section, set Function Name to eb_event_trigger and set Runtime to Python 3.6. Keep the default values for other parameters.

      • In the Trigger Configurations section, for Trigger Type, select Access Enforcement under Event Triggers for Alibaba Cloud Services. Set Name to ConfigurationItemChangeTrigger and Event Type to Select All Event Types. The event pattern is as follows:

        {
            "source": [
                "acs.ram"
            ],
            "type": [
                "ram:ActionTrail:AliyunServiceEvent",
                "ram:ActionTrail:ApiCall",
                "ram:ActionTrail:ConsoleOperation",
                "ram:Config:ConfigurationItemChangeNotification",
                "ram:Config:NonCompliantNotification"
            ]
        }

      • Keep the default values for other parameters.

      Note

      If you are connecting Function Compute to EventBridge for the first time, grant the required permissions when prompted.

   3. Click Create.

3. Modify the function code to log events.

   1. On the Function Code tab of the eb_event_trigger function, modify the index.py file. Change the line logger.info('hello world') to logger.info(event).

   2. In the upper-left corner of the editor, click Deploy Code.

Step 4: Trigger configuration changes in business accounts

To test the setup, create a RAM role named sg-01 in business account B and a RAM role named sg-02 in business account C. For more information, see Create a RAM role for a trusted Alibaba Cloud account.

Step 5: Verify events in the log account