Resource Orchestration Service (ROS) integration example

Supported resources

Resource Orchestration Service (ROS) is an Alibaba Cloud service that simplifies cloud resource management. Developers and administrators can write a template to define the Alibaba Cloud resources they require, such as ECS instances and ApsaraDB RDS database instances, and their dependencies. The ROS orchestration engine then automatically creates and configures all resources based on the template to automate deployment and operations. For more information, see What is Resource Orchestration Service?.

You can use ROS to provision the following ActionTrail resources:

• ALIYUN::ACTIONTRAIL::Trail: Creates a trail.

• ALIYUN::ACTIONTRAIL::TrailLogging: Manages the logging status of a trail.

Permissions

This example creates a trail. By default, Resource Orchestration Service uses the credentials of the user who is logged on to the console. This user must have the following permissions:

• AliyunActionTrailFullAccess: Manages permissions for ActionTrail.

• AliyunLogFullAccess: Manages permissions for Simple Log Service.

An Alibaba Cloud account has full access to all APIs, which poses a high security risk. For greater security, use a RAM user for API access or daily operations. Grant the RAM user only the required permissions. For more information, see Grant permissions to a RAM user.

Procedure

1. Log on to the ROS console. In the top navigation bar, select a region from the Region drop-down list.

2. In the left-side navigation pane, click Stacks. Then, choose Create Stack > Use ROS:

   • Specify Template: Select Select an Existing Template.

   • Template Import Method: Select Enter Template Content.

3. Under Template Content, select ROS and enter the following code in either YAML or JSON format.

   For the syntax, description, and examples of how to create a trail, see ALIYUN::ACTIONTRAIL::Trail. This example creates a trail named test-trail.

   YAML format

   ROSTemplateFormatVersion: '2015-09-01'
   Resources:
     SlsProject:
       Type: ALIYUN::SLS::Project
       Properties:
         Name: test-sls-project-for-actiontrail
     TrailLogging:
       Type: ALIYUN::ACTIONTRAIL::TrailLogging
       Properties:
         Enable: true
         Name:
           Fn::GetAtt:
             - Trail
             - Name
     SlsLogStore:
       Type: ALIYUN::SLS::Logstore
       Properties:
         ProjectName:
           Fn::GetAtt:
             - SlsProject
             - Name
         AutoSplit: true
         MaxSplitShard: 64
         LogstoreName: actiontrail_test-trail
         AppendMeta: true
         ShardCount: 2
         EnableTracking: false
         PreserveStorage: true
       DependsOn: SlsProject
     Trail:
       Type: ALIYUN::ACTIONTRAIL::Trail
       Properties:
         SlsProjectArn:
           Fn::Sub: acs:log:${ALIYUN::Region}::project/test-sls-project-for-actiontrail
         EventRW: All
         Name: test-trail
       DependsOn:
         - SlsLogStore
   Parameters: {}
   Outputs:
     Name:
       Value:
         Fn::GetAtt:
           - Trail
           - Name

   JSON format

   {
     "ROSTemplateFormatVersion": "2015-09-01",
     "Resources": {
       "SlsProject": {
         "Type": "ALIYUN::SLS::Project",
         "Properties": {
           "Name": "test-sls-project-for-actiontrail"
         }
       },
       "TrailLogging": {
         "Type": "ALIYUN::ACTIONTRAIL::TrailLogging",
         "Properties": {
           "Enable": true,
           "Name": {
             "Fn::GetAtt": [
               "Trail",
               "Name"
             ]
           }
         }
       },
       "SlsLogStore": {
         "Type": "ALIYUN::SLS::Logstore",
         "Properties": {
           "ProjectName": {
             "Fn::GetAtt": [
               "SlsProject",
               "Name"
             ]
           },
           "AutoSplit": true,
           "MaxSplitShard": 64,
           "LogstoreName": "actiontrail_test-trail",
           "AppendMeta": true,
           "ShardCount": 2,
           "EnableTracking": false,
           "PreserveStorage": true
         },
         "DependsOn": "SlsProject"
       },
       "Trail": {
         "Type": "ALIYUN::ACTIONTRAIL::Trail",
         "Properties": {
           "SlsProjectArn": {
             "Fn::Sub": "acs:log:${ALIYUN::Region}::project/test-sls-project-for-actiontrail"
           },
           "EventRW": "All",
           "Name": "test-trail"
         },
         "DependsOn": [
           "SlsLogStore"
         ]
       }
     },
     "Parameters": {},
     "Outputs": {
       "Name": {
         "Value": {
           "Fn::GetAtt": [
             "Trail",
             "Name"
           ]
         }
       }
     }
   }

4. Click Next. On the Configure Stack page, set Rollback on Failure to Yes.

5. Click Create.

6. Check the output.

   On the stack details page, a Status of CreateSucceeded indicates that the stack was created successfully.

7. After the stack is created, you can use OpenAPI, SDKs, or the ActionTrail console to find the trail named test-trail.

   In the trail list, verify that the test-trail trail has a status of Enabled, uses SLS as the storage service, tracks All regions, and is a single-account trail.