ActionTrail helps you monitor and record activity in your Alibaba Cloud account. You can use ActionTrail to audit operations performed in your Alibaba Cloud account over the last 90 days to ensure that cloud service usage meets your compliance requirements and security standards. For example, you can use ActionTrail to identify which RAM user performed which operation and when. This topic uses a nat gateway as an example to show how to query event details in ActionTrail.
Background
A team manager uses an Alibaba Cloud account to create multiple RAM users for team members and grants them administrator permissions.
Suppose that when you try to associate an EIP with a nat gateway, you discover that another EIP is already associated. Since all team members have administrator permissions, any of them could have performed this operation. You can use ActionTrail to query events for the nat gateway and identify the operator.
Procedure
-
Log on to the ActionTrail console.
-
In the left-side navigation pane, choose .
-
In the top navigation bar, select the target region.
-
From the drop-down list, select Resource Name.
NoteYou can also filter events by other conditions, such as Read/Write Type, Operator, Service Name, Event Name, Resource Type, AccessKey ID, Sensitive Operation, or Event ID.
-
Enter the instance ID of the elastic IP address, and then click the search icon
. -
In the Actions column of the target event, click View Event Details to view the event details and record code.
NoteThe event details pane shows that a RAM user associated an elastic IP address with the nat gateway at 13:42:03 on December 20, 2023. This confirms which RAM user performed the operation.
Related topics
For more information about the fields in a management event record, see Management event structure.