auditdを用いてEC2内のファイル転送系コマンドをCloudWatch Logsに収集してみた

sh-5.2$ which auditd
/usr/sbin/auditd

sh-5.2$ sudo systemctl status auditd
● auditd.service - Security Auditing Service
     Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; preset: enabled)
     Active: active (running) since Thu 2026-03-26 02:25:15 UTC; 1h 36min ago
       Docs: man:auditd(8)
             https://github.com/linux-audit/audit-documentation
   Main PID: 1267 (auditd)
      Tasks: 2 (limit: 1067)
     Memory: 2.6M
        CPU: 88ms
     CGroup: /system.slice/auditd.service
             └─1267 /sbin/auditd

sudo tree /etc/audit

/etc/audit
├── audit-stop.rules
├── audit.rules
├── auditd.conf
├── plugins.d
└── rules.d
    └── audit.rules

sudo cat /etc/audit/audit-stop.rules

# These rules are loaded when the audit daemon stops
# if configured to do so.

# Disable auditing
-e 0

# Delete all rules
-D

sudo cat /etc/audit/rules.d/audit.rules

## This set of rules is to suppress the performance effects of the
## audit system. The result is that you only get hardwired events.
-D

## This suppresses syscall auditing for all tasks started
## with this rule in effect.  Remove it if you need syscall
## auditing.
-a task,never

sh-5.2$ sudo cat /etc/audit/auditd.conf
local_events = yes
write_logs = yes
log_file = /var/log/audit/audit.log
log_group = root
log_format = ENRICHED
flush = INCREMENTAL_ASYNC
freq = 50
max_log_file = 8
num_logs = 5
priority_boost = 4
name_format = NONE
max_log_file_action = ROTATE
space_left = 75
space_left_action = SYSLOG
verify_email = yes
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
disk_error_action = SUSPEND
use_libwrap = yes
tcp_listen_queue = 5
tcp_max_per_addr = 1
tcp_client_max_idle = 0
transport = TCP
krb5_principal = auditd
distribute_network = no
q_depth = 2000
overflow_action = SYSLOG
max_restarts = 10
plugin_dir = /etc/audit/plugins.d
end_of_event_timeout = 2

sh-5.2$ sudo auditctl -l
-a never,task

sudo vi /etc/audit/rules.d/audit.rules

sh-5.2$ sudo cat /etc/audit/rules.d/audit.rules
## This set of rules is to suppress the performance effects of the
## audit system. The result is that you only get hardwired events.
-D

## This suppresses syscall auditing for all tasks started
## with this rule in effect.  Remove it if you need syscall
## auditing.
# -a task,never

sh-5.2$ which rsync
/usr/bin/rsync

sh-5.2$ which aws
/usr/bin/aws

sh-5.2$ which scp
/usr/bin/scp

# 転送コマンド監視ルールを作成（syscallベース）
sudo tee /etc/audit/rules.d/transfer-commands.rules << 'EOF'
-a always,exit -F arch=b64 -F path=/usr/bin/rsync -F perm=x -k data_transfer
-a always,exit -F arch=b64 -F path=/usr/bin/scp -F perm=x -k data_transfer
-a always,exit -F arch=b64 -F path=/usr/bin/aws -F perm=x -k data_transfer
EOF

# 出力
-a always,exit -F arch=b64 -F path=/usr/bin/rsync -F perm=x -k data_transfer
-a always,exit -F arch=b64 -F path=/usr/bin/scp -F perm=x -k data_transfer
-a always,exit -F arch=b64 -F path=/usr/bin/aws -F perm=x -k data_transfer

# rules.d/のファイルを結合して読み込み
sh-5.2$ sudo augenrules --load
No rules

# 反映されたルールの確認
sh-5.2$ sudo auditctl -l
-a always,exit -F arch=b64 -S execve -F path=/usr/bin/rsync -F perm=x -F key=data_transfer
-a always,exit -F arch=b64 -S execve -F path=/usr/bin/scp -F perm=x -F key=data_transfer
-a always,exit -F arch=b64 -S execve -F path=/usr/bin/aws -F perm=x -F key=data_transfer
sh-5.2$

which amazon-cloudwatch-agent-ctl
# 出力
which: no amazon-cloudwatch-agent-ctl in (/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin)

sudo dnf install -y amazon-cloudwatch-agent
# 出力
Last metadata expiration check: 2:30:21 ago on Thu Mar 26 02:26:04 2026.
Dependencies resolved.
===========================================================================================================================================================================================
 Package                                             Architecture                       Version                                              Repository                               Size
===========================================================================================================================================================================================
Installing:
 amazon-cloudwatch-agent                             x86_64                             1.300064.1-1.amzn2023                                amazonlinux                              67 M

Transaction Summary
===========================================================================================================================================================================================
Install  1 Package

Total download size: 67 M
Installed size: 228 M
Downloading Packages:
amazon-cloudwatch-agent-1.300064.1-1.amzn2023.x86_64.rpm                                                                                                    71 MB/s |  67 MB     00:00
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                                                                                       68 MB/s |  67 MB     00:00
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                                                                                   1/1
  Running scriptlet: amazon-cloudwatch-agent-1.300064.1-1.amzn2023.x86_64                                                                                                              1/1
create group cwagent, result: 0
create user cwagent, result: 0

  Installing       : amazon-cloudwatch-agent-1.300064.1-1.amzn2023.x86_64                                                                                                              1/1
  Running scriptlet: amazon-cloudwatch-agent-1.300064.1-1.amzn2023.x86_64                                                                                                              1/1
  Verifying        : amazon-cloudwatch-agent-1.300064.1-1.amzn2023.x86_64                                                                                                              1/1

Installed:
  amazon-cloudwatch-agent-1.300064.1-1.amzn2023.x86_64

Complete!

cat << 'EOF' > ~/data-transfer-auditd.json
{
  "agent": {
    "run_as_user": "root",
    "region": "ap-northeast-1"
  },
  "logs": {
    "logs_collected": {
      "files": {
        "collect_list": [
          {
            "file_path": "/var/log/audit/audit.log",
            "log_group_name": "/ec2/auditd",
            "log_stream_name": "{instance_id}",
            "timezone": "Local"
          }
        ]
      }
    }
  }
}
EOF

# 設定を適用して起動
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl \
  -a fetch-config \
  -m ec2 \
  -s \
  -c file:$HOME/data-transfer-auditd.json

# 出力
****** processing amazon-cloudwatch-agent ******
Starting config-downloader, this will map back to a call to amazon-cloudwatch-agent
Executing /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent with arguments: [config-downloader -config /opt/aws/amazon-cloudwatch-agent/etc/common-config.toml -multi-config default -mode ec2 -download-source file:/home/ssm-user/data-transfer-auditd.json -output-dir /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.d]I! Trying to detect region from ec2
D! [EC2] Found active network interface
I! imds retry client will retry 1 times
Start configuration validation...
2026/03/26 05:09:32 Reading json config file path: /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.d/file_data-transfer-auditd.json.tmp ...
2026/03/26 05:09:32 I! Valid Json input schema.
2026/03/26 05:09:32 Configuration validation first phase succeeded
Starting config-translator, this will map back to a call to amazon-cloudwatch-agent
Executing /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent with arguments: [config-translator -multi-config default -input /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json -input-dir /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.d -output /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.toml -mode ec2 -config /opt/aws/amazon-cloudwatch-agent/etc/common-config.toml]D! [EC2] Found active network interface
I! imds retry client will retry 1 times
/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent -schematest -config /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.toml
Configuration validation second phase succeeded
Configuration validation succeeded
amazon-cloudwatch-agent has already been stopped
Created symlink /etc/systemd/system/multi-user.target.wants/amazon-cloudwatch-agent.service → /etc/systemd/system/amazon-cloudwatch-agent.service.

# 起動ステータス確認
sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl -a status
# 出力
{
  "status": "running",
  "starttime": "2026-03-26T05:09:31+00:00",
  "configstatus": "configured",
  "version": "1.300064.1"
}

sudo ls /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.d/
# 出力
file_data-transfer-auditd.json

sudo cat /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.d/file_data-transfer-auditd.json

# 出力
{
  "agent": {
    "run_as_user": "root",
    "region": "ap-northeast-1"
  },
  "logs": {
    "logs_collected": {
      "files": {
        "collect_list": [
          {
            "file_path": "/var/log/audit/audit.log",
            "log_group_name": "/ec2/auditd",
            "log_stream_name": "{instance_id}",
            "timezone": "Local"
          }
        ]
      }
    }
  }
}

mkdir -p /tmp/test-data
echo "test data" > /tmp/test-data/sample.txt

sh-5.2$ rsync -av /tmp/test-data/ /tmp/rsync-dest/
sending incremental file list

sent 89 bytes  received 12 bytes  202.00 bytes/sec
total size is 10  speedup is 0.10

aws s3 cp /tmp/test-data/sample.txt s3://auditd-transfer-test-demo-bucket/sample.txt
upload: ../../tmp/test-data/sample.txt to s3://auditd-transfer-test-demo-bucket/sample.txt

sh-5.2$ mkdir -p /tmp/scp-data
scp /tmp/test-data/sample.txt /tmp/scp-data/sample.txt
cat /tmp/scp-data/sample.txt
test data

sudo ausearch -k data_transfer --interpret

type=PROCTITLE : proctitle=rsync -av /tmp/test-data/ /tmp/rsync-dest/
type=PATH      : item=0 name=/usr/bin/rsync inode=1035529 ...
type=CWD       : cwd=/home/ssm-user
type=EXECVE    : argc=4 a0=rsync a1=-av a2=/tmp/test-data/ a3=/tmp/rsync-dest/
type=SYSCALL   : arch=x86_64 syscall=execve success=yes ... uid=ssm-user ... exe=/usr/bin/rsync ... key=data_transfer

type=PROCTITLE : proctitle=/usr/bin/python3 -s /usr/bin/aws s3 cp /tmp/test-data/sample.txt s3://auditd-transfer-test-demo-bucket/sample.txt
type=EXECVE    : argc=7 a0=/usr/bin/python3 a1=-s a2=/usr/bin/aws a3=s3 a4=cp a5=/tmp/test-data/sample.txt a6=s3://auditd-transfer-test-demo-bucket/sample.txt
type=SYSCALL   : ... comm=aws exe=/usr/bin/python3.9 ... key=data_transfer

type=PROCTITLE : proctitle=scp /tmp/test-data/sample.txt /tmp/scp-data/sample.txt
type=EXECVE    : argc=3 a0=scp a1=/tmp/test-data/sample.txt a2=/tmp/scp-data/sample.txt
type=SYSCALL   : ... comm=scp exe=/usr/bin/scp ... key=data_transfer