Systems Manager で実現する Windows イベントログの自動アーカイブをやってみた

# Define variables
$backupDir = "C:\BackUp"
$bucketName = "<バケット名>"
$date = Get-Date -Format "yyyyMMdd"
$logFile = "$backupDir\UploadErrorLog_$date.txt"
$logs = @("Application", "Security", "System")

# Retrieve instance ID using IMDSv2
try {
    $token = Invoke-RestMethod -Uri "http://169.254.169.254/latest/api/token" -Method PUT -Headers @{"X-aws-ec2-metadata-token-ttl-seconds"="21600"} -ErrorAction Stop
    $instanceId = Invoke-RestMethod -Uri "http://169.254.169.254/latest/meta-data/instance-id" -Headers @{"X-aws-ec2-metadata-token"=$token} -ErrorAction Stop
} catch {
    Write-Host "Failed to retrieve instance metadata. Error: $_"
    exit 1
}

# Check if the backup directory exists
if (!(Test-Path $backupDir)) {
    New-Item -ItemType Directory -Path $backupDir | Out-Null
}

# Export event logs
$exportedFiles = @()
$uploadSuccess = $true 

foreach ($log in $logs) {
    $logPath = "$backupDir\$date`_$log.evtx"

    # Check if any logs were exported
    try {
        Write-Host "Exporting $log log to $logPath ..."
        wevtutil epl $log $logPath /ow:true
        if (Test-Path $logPath) {
            $exportedFiles += $logPath
            Write-Host "Successfully exported $log log."
        } else {
            throw "Failed to export $log log. File not found: $logPath"
        }
    } catch {
        $errorMessage = "Error exporting $log log: $_"
        Write-Host $errorMessage
        $errorMessage | Out-File -Append -FilePath $logFile
        $uploadSuccess = $false
    }
}

# Check if any logs were exported
if ($exportedFiles.Count -eq 0) {
    Write-Host "No logs were exported. Exiting script."
    exit 1
}

# Upload logs to S3
foreach ($file in $exportedFiles) {
    $fileName = [System.IO.Path]::GetFileName($file)
    $s3Key = "$instanceId/EventLogs/$fileName"
    Write-Host "Uploading $file to s3://$bucketName/$s3Key ..."

    try {
        Write-S3Object -BucketName $bucketName -File $file -Key $s3Key -ErrorAction Stop
    } catch {
        $errorMessage = "Failed to upload $file to S3. Error: $_"
        Write-Host $errorMessage
        $errorMessage | Out-File -Append -FilePath $logFile
        $uploadSuccess = $false
    }
}

# Delete backup folder if all uploads were successful
if ($uploadSuccess) {
    Write-Host "All logs uploaded successfully."
    Remove-Item -Path $backupDir -Recurse -Force
} else {
    Write-Host "Some logs failed to upload. Backup folder will not be deleted."
    Write-Host "Check error log: $logFile"
}

Write-Host "Backup and upload process completed."

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": [
                "arn:aws:s3:::<バケット名>/*"
            ]
        }
    ]
}

aws ssm create-maintenance-window \
    --name "EventLogBackUp" \
    --schedule "cron(0 0 22 ? * * *)" \
    --schedule-timezone "Asia/Tokyo" \
    --duration 1 \
    --cutoff 0 \
    --allow-unassociated-targets

aws ssm register-target-with-maintenance-window \
    --window-id <ウィンドウ ID> \
    --resource-type INSTANCE \
    --targets "Key=tag:env,Values=prod" \
    --name "prodserver"

aws ssm register-task-with-maintenance-window \
    --window-id <ウィンドウ ID>  \
    --targets "Key=WindowTargetIds,Values=<ウィンドウのターゲット ID>" \
    --task-arn "AWS-RunPowerShellScript" \
    --task-type "RUN_COMMAND" \
    --task-invocation-parameters '{
        "RunCommand": {
            "Comment": "EventLogBackUpTask",
            "DocumentVersion": "$DEFAULT",
            "TimeoutSeconds": 600,
            "Parameters": {
                "commands": ["# Define variables","$backupDir = \"C:\\BackUp\"","$bucketName = \"<バケット名>\"","$date = Get-Date -Format \"yyyyMMdd\"","$logFile = \"$backupDir\\UploadErrorLog_$date.txt\"","$logs = @(\"Application\", \"Security\", \"System\")","","# Retrieve instance ID using IMDSv2","try {"," $token = Invoke-RestMethod -Uri \"http://169.254.169.254/latest/api/token\" -Method PUT -Headers @{\"X-aws-ec2-metadata-token-ttl-seconds\"=\"21600\"} -ErrorAction Stop"," $instanceId = Invoke-RestMethod -Uri \"http://169.254.169.254/latest/meta-data/instance-id\" -Headers @{\"X-aws-ec2-metadata-token\"=$token} -ErrorAction Stop","} catch {"," Write-Host \"Failed to retrieve instance metadata. Error: $_\""," exit 1","}","","# Check if the backup directory exists","if (!(Test-Path $backupDir)) {"," New-Item -ItemType Directory -Path $backupDir | Out-Null","}","","# Export event logs","$exportedFiles = @()","$uploadSuccess = $true ","","foreach ($log in $logs) {"," $logPath = \"$backupDir\\$date`_$log.evtx\""," "," # Check if any logs were exported"," try {"," Write-Host \"Exporting $log log to $logPath ...\""," wevtutil epl $log $logPath /ow:true"," if (Test-Path $logPath) {"," $exportedFiles += $logPath"," Write-Host \"Successfully exported $log log.\""," } else {"," throw \"Failed to export $log log. File not found: $logPath\""," }"," } catch {"," $errorMessage = \"Error exporting $log log: $_\""," Write-Host $errorMessage"," $errorMessage | Out-File -Append -FilePath $logFile"," $uploadSuccess = $false"," }","}","","# Check if any logs were exported","if ($exportedFiles.Count -eq 0) {"," Write-Host \"No logs were exported. Exiting script.\""," exit 1","}","","# Upload logs to S3","foreach ($file in $exportedFiles) {"," $fileName = [System.IO.Path]::GetFileName($file)"," $s3Key = \"$instanceId/EventLogs/$fileName\""," Write-Host \"Uploading $file to s3://$bucketName/$s3Key ...\"",""," try {"," Write-S3Object -BucketName $bucketName -File $file -Key $s3Key -ErrorAction Stop"," } catch {"," $errorMessage = \"Failed to upload $file to S3. Error: $_\""," Write-Host $errorMessage"," $errorMessage | Out-File -Append -FilePath $logFile"," $uploadSuccess = $false"," }","}","","# Delete backup folder if all uploads were successful","if ($uploadSuccess) {"," Write-Host \"All logs uploaded successfully.\""," Remove-Item -Path $backupDir -Recurse -Force","} else {"," Write-Host \"Some logs failed to upload. Backup folder will not be deleted.\""," Write-Host \"Check error log: $logFile\"","}","","Write-Host \"Backup and upload process completed.\""]
            }
        }
    }' \
    --priority 1 \
    --max-concurrency "50%" \
    --max-errors "50%" \
    --name "EventLogBackUpTask"