Documentation
¶
Overview ¶
Package cloudtrail provides CloudTrail event parsing, conversion, and replay for recreating AWS resource state from audit logs.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ConvertToRequest ¶
func ConvertToRequest(event CloudTrailEvent, endpoint string) (*http.Request, error)
ConvertToRequest converts a CloudTrail event into an HTTP request suitable for sending to a CloudMock endpoint.
func SortByTime ¶
func SortByTime(events []CloudTrailEvent)
SortByTime sorts events chronologically by eventTime.
Types ¶
type CloudTrailEvent ¶
type CloudTrailEvent struct {
EventVersion string `json:"eventVersion"`
EventSource string `json:"eventSource"`
EventName string `json:"eventName"`
AWSRegion string `json:"awsRegion"`
EventTime string `json:"eventTime"`
SourceIPAddress string `json:"sourceIPAddress"`
UserIdentity map[string]any `json:"userIdentity"`
RequestParameters map[string]any `json:"requestParameters"`
ResponseElements map[string]any `json:"responseElements"`
ErrorCode string `json:"errorCode"`
ErrorMessage string `json:"errorMessage"`
ReadOnly bool `json:"readOnly"`
}
CloudTrailEvent represents a single CloudTrail event record.
func FilterByServices ¶
func FilterByServices(events []CloudTrailEvent, services []string) []CloudTrailEvent
FilterByServices returns only events matching the given service names.
func FilterWriteEvents ¶
func FilterWriteEvents(events []CloudTrailEvent) []CloudTrailEvent
FilterWriteEvents returns only events that modify state (not read-only).
func ParseFile ¶
func ParseFile(path string) ([]CloudTrailEvent, error)
ParseFile reads a CloudTrail JSON file and returns the events.
func ParseJSON ¶
func ParseJSON(data []byte) ([]CloudTrailEvent, error)
ParseJSON parses CloudTrail JSON data (a Records array) and returns the events.
func (*CloudTrailEvent) ParsedTime ¶
func (e *CloudTrailEvent) ParsedTime() time.Time
ParsedTime returns the eventTime parsed as time.Time.
func (*CloudTrailEvent) ServiceName ¶
func (e *CloudTrailEvent) ServiceName() string
ServiceName extracts the service from eventSource (e.g., "s3.amazonaws.com" -> "s3").
type CloudTrailLog ¶
type CloudTrailLog struct {
Records []CloudTrailEvent `json:"Records"`
}
CloudTrailLog is the top-level wrapper for a CloudTrail JSON file.
type ReplayConfig ¶
type ReplayConfig struct {
Endpoint string // CloudMock gateway URL
Speed float64 // 0 = instant, 1.0 = realtime
FilterWrite bool // If true, skip read-only events
Services []string // If non-empty, only replay matching services
}
ReplayConfig controls how events are replayed against a CloudMock endpoint.
type ReplayError ¶
type ReplayError struct {
EventName string `json:"event_name"`
Service string `json:"service"`
Error string `json:"error"`
Status int `json:"status"`
}
ReplayError records a single failed replay attempt.
type ReplayResult ¶
type ReplayResult struct {
TotalEvents int `json:"total_events"`
Replayed int `json:"replayed"`
Skipped int `json:"skipped"`
Succeeded int `json:"succeeded"`
Failed int `json:"failed"`
Errors []ReplayError `json:"errors,omitempty"`
Duration time.Duration `json:"duration"`
}
ReplayResult summarizes the outcome of a replay run.
func Replay ¶
func Replay(events []CloudTrailEvent, cfg ReplayConfig) (*ReplayResult, error)
Replay sends CloudTrail events to a CloudMock endpoint according to the provided configuration and returns a summary of the results.
Source Files