你当前正在访问 Microsoft Azure Global Edition 技术文档网站。 如果需要访问由世纪互联运营的 Microsoft Azure 中国技术文档网站，请访问 https://docs.azure.cn。
使用 Azure Arc 启用的多云连接器查看多云清单
多云连接器的清单解决方案显示 Azure 中来自其他公有云的资源的最新视图，提供一个单一位置来查看所有云资源。 目前，支持 AWS 公有云环境。
启用清单解决方案后，来自源云中的资产的元数据包含在 Azure 中的资产表示形式中。 还可以将 Azure 标记或 Azure 策略应用于这些资源。 借助此解决方案，可通过 Azure Resource Graph 查询所有云资源，例如查询来查找具有特定标记的所有 Azure 和 AWS 资源。
清单解决方案会定期扫描源云，以更新 Azure 中表示的视图。 可以在连接公有云和配置清单解决方案时，指定查询间隔。
支持的 AWS 服务
现在，与以下 AWS 服务关联的资源会被扫描并在 Azure 中表示。 创建清单解决方案时，默认情况下会选择所有可用服务，但是你可选择包括任何服务。
下表显示了已扫描的 AWS 服务、与每个服务关联的资源类型，以及对应于每种资源类型的 Azure 命名空间。
| AWS 服务 | AWS 资源类型 | Azure 命名空间 |
|---|---|---|
| 访问分析器 | accessAnalyzerAnalyzers |
Microsoft.AwsConnector/accessAnalyzerAnalyzers |
| API Gateway | apiGatewayRestApis |
Microsoft.AwsConnector/apiGatewayRestApis |
| API Gateway | apiGatewayStages |
Microsoft.AwsConnector/apiGatewayStages |
| 应用同步 | appSyncGraphQLApis |
Microsoft.AwsConnector/appSyncGraphQLApis |
| 自动缩放 | autoScalingAutoScalingGroups |
Microsoft.AwsConnector/autoScalingAutoScalingGroups |
| Cloud Formation | cloudFormationStacks |
Microsoft.AwsConnector/cloudFormationStacks |
| Cloud Formation | cloudFormationStackSets |
Microsoft.AwsConnector/cloudFormationStackSets |
| Cloud Front | cloudFront |
Microsoft.AwsConnector/cloudFrontDistributions |
| Cloud Trail | cloudTrailTrails |
Microsoft.AwsConnector/cloudTrailTrails |
| Cloud Watch | cloudWatchAlarms |
Microsoft.AwsConnector/cloudWatchAlarms |
| 代码生成 | codeBuildProjects |
Microsoft.AwsConnector/codeBuildProjects |
| 代码生成 | codeBuildSourceCredentialsInfos |
Microsoft.AwsConnector/codeBuildSourceCredentialsInfos |
| Config | configServiceConfigurationRecorders |
Microsoft.AwsConnector/configServiceConfigurationRecorders |
| Config | configServiceConfigurationRecorderStatuses |
Microsoft.AwsConnector/configServiceConfigurationRecorderStatuses |
| Config | configServiceDeliveryChannels |
Microsoft.AwsConnector/configServiceDeliveryChannels |
| DAX | daxClusters |
Microsoft.AwsConnector/daxClusters |
| DMS | databaseMigrationServiceReplicationInstances |
Microsoft.AwsConnector/databaseMigrationServiceReplicationInstances |
| Dynamo DB | dynamoDBContinuousBackupsDescriptions |
Microsoft.AwsConnector/dynamoDBContinuousBackupsDescriptions |
| Dynamo DB | dynamoDBTables |
Microsoft.AwsConnector/dynamoDBTables |
| EC2 | ec2Instances |
Microsoft.HybridCompute/machines/EC2InstanceId、Microsoft.AwsConnector/Ec2Instances |
| EC2 | ec2AccountAttributes |
Microsoft.AwsConnector/ec2AccountAttributes |
| EC2 | ec2Addresses |
Microsoft.AwsConnector/ec2Addresses |
| EC2 | ec2FlowLogs |
Microsoft.AwsConnector/ec2FlowLogs |
| EC2 | ec2Images |
Microsoft.AwsConnector/ec2Images |
| EC2 | ec2Ipams |
Microsoft.AwsConnector/ec2Ipams |
| EC2 | ec2KeyPairs |
Microsoft.AwsConnector/ec2KeyPairs |
| EC2 | ec2Subnets |
Microsoft.AwsConnector/ec2Subnets |
| EC2 | ec2Volumes |
Microsoft.AwsConnector/ec2Volumes |
| EC2 | ec2VPCs |
Microsoft.AwsConnector/ec2VPCs |
| EC2 | ec2NetworkAcls |
Microsoft.AwsConnector/ec2NetworkAcls |
| EC2 | ec2NetworkInterfaces |
Microsoft.AwsConnector/ec2NetworkInterfaces |
| EC2 | ec2RouteTables |
Microsoft.AwsConnector/ec2RouteTables |
| EC2 | ec2VPCEndpoints |
Microsoft.AwsConnector/ec2VPCEndpoints |
| EC2 | ec2VPCPeeringConnections |
Microsoft.AwsConnector/ec2VPCPeeringConnections |
| EC2 | ec2InstanceStatuses |
Microsoft.AwsConnector/ec2InstanceStatuses |
| EC2 | ec2SecurityGroups |
Microsoft.AwsConnector/ec2SecurityGroups |
| EC2 | ec2Snapshots |
Microsoft.AwsConnector/ec2Snapshots |
| ECR | ecrImageDetails |
Microsoft.AwsConnector/ecrImageDetails |
| ECR | ecrRepositories |
Microsoft.AwsConnector/ecrRepositories |
| ECS | ecsClusters |
Microsoft.AwsConnector/ecsClusters |
| ECS | ecsServices |
Microsoft.AwsConnector/ecsServices |
| ECS | ecsTaskDefinitions |
Microsoft.AwsConnector/ecsTaskDefinitions |
| EFS | efsFileSystems |
Microsoft.AwsConnector/efsFileSystems |
| EFS | efsMountTargets |
Microsoft.AwsConnector/efsMountTargets |
| EKS | eksClusters |
Microsoft.AwsConnector/eksClusters |
| EKS | eksNodegroups |
Microsoft.AwsConnector/eksNodegroups |
| Elastic Beanstalk | elasticBeanstalkApplications |
Microsoft.AwsConnector/elasticBeanstalkApplications |
| Elastic Beanstalk | elasticBeanstalkConfigurationTemplates |
Microsoft.AwsConnector/elasticBeanstalkConfigurationTemplates |
| Elastic Beanstalk | elasticBeanstalkEnvironments |
Microsoft.AwsConnector/elasticBeanstalkEnvironments |
| 弹性负载均衡器 V2 | elasticLoadBalancingV2LoadBalancers |
Microsoft.AwsConnector/elasticLoadBalancingV2LoadBalancers |
| 弹性负载均衡器 V2 | elasticLoadBalancingV2Listeners |
Microsoft.AwsConnector/elasticLoadBalancingV2Listeners |
| 弹性负载均衡器 V2 | elasticLoadBalancingV2TargetGroups |
Microsoft.AwsConnector/elasticLoadBalancingV2TargetGroups |
| 弹性负载均衡器 V2 | elasticLoadBalancingV2TargetHealthDescriptions |
Microsoft.AwsConnector/elasticLoadBalancingV2TargetHealthDescriptions |
| EMR | emrClusters |
Microsoft.AwsConnector/emrClusters |
| GuardDuty | guardDutyDetectors |
Microsoft.AwsConnector/guardDutyDetectors |
| IAM | iamAccessKeyLastUseds |
Microsoft.AwsConnector/iamAccessKeyLastUseds |
| IAM | iamAccessKeyMetaData |
Microsoft.AwsConnector/iamAccessKeyMetaData |
| IAM | iamMFADevices |
Microsoft.AwsConnector/iamMFADevices |
| IAM | iamPasswordPolicies |
Microsoft.AwsConnector/iamPasswordPolicies |
| IAM | iamPolicyVersions |
Microsoft.AwsConnector/iamPolicyVersions |
| IAM | iamRoles |
Microsoft.AwsConnector/iamRoles |
| IAM | iamManagedPolicies |
Microsoft.AwsConnector/iamManagedPolicies |
| IAM | iamServerCertificates |
Microsoft.AwsConnector/iamServerCertificates |
| IAM | iamUserPolicies |
Microsoft.AwsConnector/iamUserPolicies |
| IAM | iamVirtualMFADevices |
Microsoft.AwsConnector/iamVirtualMFADevices |
| KMS | kmsKeys |
Microsoft.AwsConnector/kmsKeys |
| Lambda | lambdaFunctions |
Microsoft.AwsConnector/lambdaFunctions |
| Lightsail | lightsailInstances |
Microsoft.AwsConnector/lightsailInstances |
| Lightsail | lightsailBuckets |
Microsoft.AwsConnector/lightsailBuckets |
| 日志 | logsLogGroups |
Microsoft.AwsConnector/logsLogGroups |
| 日志 | logsLogStreams |
Microsoft.AwsConnector/logsLogStreams |
| 日志 | logsMetricFilters |
Microsoft.AwsConnector/logsMetricFilters |
| 日志 | logsSubscriptionFilters |
Microsoft.AwsConnector/logsSubscriptionFilters |
| Macie | macieAllowLists |
Microsoft.AwsConnector/macieAllowLists |
| Macie2 | macie2JobSummaries |
Microsoft.AwsConnector/macie2JobSummaries |
| 网络防火墙 | networkFirewallFirewalls |
Microsoft.AwsConnector/networkFirewallFirewalls |
| 网络防火墙 | networkFirewallFirewallPolicies |
Microsoft.AwsConnector/networkFirewallFirewallPolicies |
| 网络防火墙 | networkFirewallRuleGroups |
Microsoft.AwsConnector/networkFirewallRuleGroups |
| 打开搜索服务 | openSearchDomainStatuses |
Microsoft.AwsConnector/openSearchDomainStatuses |
| 组织 | organizationsAccounts |
Microsoft.AwsConnector/organizationsAccounts |
| 组织 | organizationsOrganizations |
Microsoft.AwsConnector/organizationsOrganizations |
| RDS | rdsDBInstances |
Microsoft.AwsConnector/rdsDBInstances |
| RDS | rdsDBClusters |
Microsoft.AwsConnector/rdsDBClusters |
| RDS | rdsEventSubscriptions |
Microsoft.AwsConnector/rdsEventSubscriptions |
| RDS | rdsDBSnapshots |
Microsoft.AwsConnector/rdsDBSnapshots |
| RDS | rdsDBSnapshotAttributesResults |
Microsoft.AwsConnector/rdsDBSnapshotAttributesResults |
| RDS | rdsEventSubscriptions |
Microsoft.AwsConnector/rdsEventSubscriptions |
| Redshift | redshiftClusters |
Microsoft.AwsConnector/redshiftClusters |
| Redshift | redshiftClusterParameterGroups |
Microsoft.AwsConnector/redshiftClusterParameterGroups |
| Route 53 | route53DomainsDomainSummaries |
Microsoft.AwsConnector/route53DomainsDomainSummaries |
| Route 53 | route53HostedZones |
Microsoft.AwsConnector/route53HostedZones |
| SageMaker | sageMakerApps |
Microsoft.AwsConnector/sageMakerApps |
| SageMaker | sageMakerDevices |
Microsoft.AwsConnector/sageMakerDevices |
| SageMaker | sageMakerImages |
Microsoft.AwsConnector/sageMakerImages |
| SageMaker | sageMakerNotebookInstanceSummaries |
Microsoft.AwsConnector/sageMakerNotebookInstanceSummaries |
| 机密管理器 | secretsManagerResourcePolicies |
Microsoft.AwsConnector/secretsManagerResourcePolicies |
| 机密管理器 | secretsManagerSecrets |
Microsoft.AwsConnector/secretsManagerSecrets |
| 机密管理器 | secretsManagerSecrets |
Microsoft.AwsConnector/secretsManagerSecrets |
| S3 | s3Buckets |
Microsoft.AwsConnector/s3Buckets |
| S3 | s3AccessControlPolicies |
Microsoft.AwsConnector/s3AccessControlPolicies |
| S3 | s3ControlMultiRegionAccessPointPolicyDocuments |
Microsoft.AwsConnector/s3ControlMultiRegionAccessPointPolicyDocuments |
| S3 | s3BucketPolicies |
Microsoft.AwsConnector/s3BucketPolicies |
| S3 | s3AccessPoints |
Microsoft.AwsConnector/s3AccessPoints |
| SNS | snsTopics |
Microsoft.AwsConnector/snsTopics |
| SNS | snsSubscriptions |
Microsoft.AwsConnector/snsSubscriptions |
| SQS | sqsQueues |
Microsoft.AwsConnector/sqsQueues |
| SSM | ssmInstanceInformations |
Microsoft.AwsConnector/ssmInstanceInformations |
| SSM | ssmParameters |
Microsoft.AwsConnector/ssmParameters |
| SSM | ssmResourceComplianceSummaryItems |
Microsoft.AwsConnector/ssmResourceComplianceSummaryItems |
| WAF | wafWebACLSummaries |
Microsoft.AwsConnector/wafWebACLSummaries |
| WAFv2 | wafv2LoggingConfigurations |
Microsoft.AwsConnector/wafv2LoggingConfigurations |
Azure 中的 AWS 资源表示形式
连接 AWS 云并启用清单解决方案后，多云连接器会使用命名约定 aws_yourAwsAccountId 创建一个新的资源组。 使用上一部分所述的 AwsConnector 命名空间值，在此资源组中创建 AWS 资源的 Azure 表示形式。 可以将 Azure 标记和策略应用于这些资源。
在 AWS 中发现并投影到 Azure 的资源将使用标准映射方案放置在 Azure 区域中。
注意
如果 EC2 实例已连接到 Azure Arc，则在 Arc 计算机所在的订阅中满足先决条件时，连接器将创建 EC2 清单资源作为 Microsoft.HybridCompute/machines 的子资源。 否则，将不会创建清单资源。
权限选项
全局读取：提供对 AWS 帐户中所有资源的只读访问权限。 引入新服务后，连接器可以扫描这些资源，而无需更新 CloudFormation 模板。
最小特权访问：仅提供对所选服务下资源的读取访问权限。 如果将来选择扫描更多资源，则需要上传新的 CloudFormation 模板。
定期同步选项
配置清单解决方案时选择的定期同步时间决定了 AWS 帐户进行扫描和同步到 Azure 的频率。 通过启用定期同步，AWS 资源的更改将反映在 Azure 中。 例如，如果在 AWS 中删除某个资源，则也会在 Azure 中删除该资源。
如果愿意，可以在配置此解决方案时关闭定期同步。 如果这样做，Azure 表示形式可能与 AWS 资源不同步，因为 Azure 无法重新扫描和检测任何更改。
在 Azure Resource Graph 中查询资源
Azure Resource Graph 是一项 Azure 服务，旨在通过提供高效、高性能的资源探索来扩展 Azure 资源管理。 跨一组给定的订阅大规模运行查询可帮助你有效地控制环境。
可以使用 Azure 门户中的 Resource Graph 资源管理器运行查询。 此处显示了常见方案的一些示例查询。
查询所有载入的多云资产清单
resources
| where subscriptionId == "<subscription ID>"
| where id contains "microsoft.awsconnector"
| union (awsresources | where type == "microsoft.awsconnector/ec2instances" and subscriptionId =="<subscription ID>")
| extend awsTags= properties.awsTags, azureTags = ['tags']
| project subscriptionId, resourceGroup, type, id, awsTags, azureTags, properties
查询特定连接器下的所有资源
resources
| extend connectorId = tolower(tostring(properties.publicCloudConnectorsResourceId)), resourcesId=tolower(id)
| join kind=leftouter (
awsresources
| extend pccId = tolower(tostring(properties.publicCloudConnectorsResourceId)), awsresourcesId=tolower(id)
| extend parentId = substring(awsresourcesId, 0, strlen(awsresourcesId) - strlen("/providers/microsoft.awsconnector/ec2instances/default"))
) on $left.resourcesId == $right.parentId
| where connectorId =~ "yourConnectorId" or pccId =~ "yourConnectorId"
| extend resourceType = tostring(split(iif (type =~ "microsoft.hybridcompute/machines", type1, type), "/")[1])
查询 Azure 和 AWS 中的所有虚拟机及其实例大小
resources
| where (['type'] == "microsoft.compute/virtualmachines")
| union (awsresources | where type == "microsoft.awsconnector/ec2instances")
| extend cloud=iff(type contains "ec2", "AWS", "Azure")
| extend awsTags=iff(type contains "microsoft.awsconnector", properties.awsTags, ""), azureTags=tags
| extend size=iff(type contains "microsoft.compute", properties.hardwareProfile.vmSize, properties.awsProperties.instanceType.value)
| project subscriptionId, cloud, resourceGroup, id, size, azureTags, awsTags, properties
跨 Azure 和 AWS 查询所有函数
resources
| where (type == 'microsoft.web/sites' and ['kind'] contains 'functionapp') or type == "microsoft.awsconnector/lambdafunctionconfigurations"
| extend cloud=iff(type contains "awsconnector", "AWS", "Azure")
| extend functionName=iff(cloud=="Azure", properties.name,properties.awsProperties.functionName), state=iff(cloud=="Azure", properties.state, properties.awsProperties.state), lastModifiedTime=iff(cloud=="Azure", properties.lastModifiedTimeUtc,properties.awsProperties.lastModified), location=iff(cloud=="Azure", location,properties.awsRegion), tags=iff(cloud=="Azure", tags, properties.awsTags)
| project cloud, functionName, lastModifiedTime, location, tags
查询具有特定标记的所有资源
resources
| extend awsTags=iff(type contains "microsoft.awsconnector", properties.awsTags, ""), azureTags=tags
| where awsTags contains "<yourTagValue>" or azureTags contains "<yourTagValue>"
| project subscriptionId, resourceGroup, name, azureTags, awsTags
后续步骤
- 了解多云连接器“Arc 载入”解决方案。
- 详细了解 Azure Resource Graph。