ActionTrail records events related to its own operations. This topic provides sample event logs for ActionTrail operations and describes the key fields in those logs.
Modify a trail using an Alibaba Cloud account in the console
The caller is an Alibaba Cloud (root) account. In this example, the account modified the trail alicetest in the China (Hangzhou) region using the ActionTrail console at 08:25:26 on August 5, 2021 (UTC+8).
{
"eventId": "A5A4BB74-EFBC-5D8B-BD8A-1B9131429438",
"eventVersion": 1,
"responseElements": {
"SlsProjectArn": "acs:log:cn-hangzhou:196813227629****:project/limansls",
"EventRW": "Write",
"RequestId": "A5A4BB74-EFBC-5D8B-BD8A-1B9131429438",
"HomeRegion": "cn-hangzhou",
"OssKeyPrefix": "",
"OssBucketName": "",
"SlsWriteRoleArn": "acs:ram::196813227629****:role/aliyunserviceroleforactiontrail",
"OssWriteRoleArn": "",
"TrailRegion": "All",
"Name": "alicetest"
},
"eventSource": "actiontrail-openapi-share.cn-hangzhou.aliyuncs.com",
"requestParameters": {
"SlsLogStore": "actiontrail_test",
"charset": "UTF-8",
"AcsHost": "actiontrail-openapi-share.cn-hangzhou.aliyuncs.com",
"RequestId": "A5A4BB74-EFBC-5D8B-BD8A-1B9131429438",
"HostId": "actiontrail-openapi-share.cn-hangzhou.aliyuncs.com",
"TrailRegion": "All",
"Name": "limantest",
"SlsProjectArn": "acs:log:cn-hangzhou:196813227629****:project/Alicesls",
"EventRW": "Write",
"AcsProduct": "Actiontrail",
"OssKeyPrefix": "",
"AcceptLanguage": "zh-CN",
"Region": "cn-hangzhou",
"OssBucketName": ""
},
"sourceIpAddress": "2409:8a20:4d15:e150:90f5:26ed:cc45:6922",
"userAgent": "actiontrail.console.aliyun.com",
"eventType": "ApiCall",
"referencedResources": {
"ACS::ActionTrail::Trail": [
"alicetest"
]
},
"userIdentity": {
"sessionContext": {
"attributes": {
"mfaAuthenticated": "false",
"creationDate": "2021-08-05T00:25:25Z"
}
},
"accountId": "196813227629****",
"principalId": "196813227629****",
"type": "root-account",
"userName": "root"
},
"serviceName": "Actiontrail",
"additionalEventData": {
"Scheme": "http",
"CallerBid": "26842"
},
"apiVersion": "2020-07-06",
"requestId": "A5A4BB74-EFBC-5D8B-BD8A-1B9131429438",
"eventTime": "2021-08-05T00:25:26Z",
"isGlobal": false,
"acsRegion": "cn-hangzhou",
"eventName": "UpdateTrail"
}Key fields in this example:
userIdentity.type: the identity type of the caller.root-accountindicates an Alibaba Cloud account.serviceName: the Alibaba Cloud service that generated the event.Actiontrailindicates ActionTrail.eventName: the name of the event.UpdateTrailindicates that a trail was modified.referencedResources: the resources involved in the event.{"ACS::ActionTrail::Trail": ["alicetest"}identifies thealicetesttrail.acsRegion: the region where the event occurred.cn-hangzhouindicates the China (Hangzhou) region.eventTime: the time of the event in UTC.2021-08-05T00:25:26Zcorresponds to 08:25:26 on August 5, 2021 (UTC+8).
Modify a trail as a RAM user in the console
The caller is a RAM user. In this example, RAM user Alice modified the trail test-trail in the China (Hangzhou) region using the ActionTrail console at 17:57:32 on August 5, 2021 (UTC+8).
{
"eventId": "86045124-4D86-5AD3-8848-CF78A20402AC",
"eventVersion": 1,
"responseElements": {
"SlsProjectArn": "acs:log:cn-hangzhou:189217171671****:project/test-123",
"EventRW": "Write",
"RequestId": "86045124-4D86-5AD3-8848-CF78A20402AC",
"HomeRegion": "cn-hangzhou",
"OssKeyPrefix": "",
"OssBucketName": "",
"SlsWriteRoleArn": "acs:ram::189217171671****:role/aliyunserviceroleforactiontrail",
"OssWriteRoleArn": "",
"TrailRegion": "All",
"Name": "test-trail"
},
"eventSource": "actiontrail-openapi-share.cn-hangzhou.aliyuncs.com",
"requestParameters": {
"SlsLogStore": "actiontrail_test-trail",
"charset": "UTF-8",
"AcsHost": "actiontrail-openapi-share.cn-hangzhou.aliyuncs.com",
"RequestId": "86045124-4D86-5AD3-8848-CF78A20402AC",
"HostId": "actiontrail-openapi-share.cn-hangzhou.aliyuncs.com",
"TrailRegion": "All",
"Name": "test-nnn",
"SlsProjectArn": "acs:log:cn-hangzhou:189217171671****:project/test-123",
"EventRW": "Write",
"AcsProduct": "Actiontrail",
"OssKeyPrefix": "",
"AcceptLanguage": "zh-CN",
"Region": "cn-hangzhou",
"OssBucketName": ""
},
"sourceIpAddress": "192.168.XX.XX",
"userAgent": "actiontrail.console.aliyun.com",
"eventType": "ApiCall",
"referencedResources": {
"ACS::ActionTrail::Trail": [
"test-trail"
]
},
"userIdentity": {
"sessionContext": {
"attributes": {
"mfaAuthenticated": "false",
"creationDate": "2021-08-05T09:57:32Z"
}
},
"accountId": "189217171671****",
"principalId": "26135379175722****",
"type": "ram-user",
"userName": "Alice"
},
"serviceName": "Actiontrail",
"additionalEventData": {
"Scheme": "http",
"CallerBid": "26842"
},
"apiVersion": "2020-07-06",
"requestId": "86045124-4D86-5AD3-8848-CF78A20402AC",
"eventTime": "2021-08-05T09:57:32Z",
"isGlobal": false,
"acsRegion": "cn-hangzhou",
"eventName": "UpdateTrail"
}Key fields in this example:
userIdentity.type: the identity type of the caller.ram-userindicates a RAM user.userIdentity.userName: the username of the RAM user.serviceName: the Alibaba Cloud service that generated the event.Actiontrailindicates ActionTrail.eventName: the name of the event.UpdateTrailindicates that a trail was modified.referencedResources: the resources involved in the event.{"ACS::ActionTrail::Trail": ["test-trail"]}identifies thetest-trailtrail.acsRegion: the region where the event occurred.cn-hangzhouindicates the China (Hangzhou) region.eventTime: the time of the event in UTC.2021-08-05T09:57:32Zcorresponds to 17:57:32 on August 5, 2021 (UTC+8).
Modify a trail by calling UpdateTrail as a RAM user with an AccessKey pair
The caller is a RAM user authenticating with an AccessKey pair. In this example, RAM user Alice modified the trail tf-testaccactiontrail in the China (Hangzhou) region by calling the UpdateTrail operation at 10:29:37 on August 4, 2021 (UTC+8) using AccessKey ID LTAI.
{
"eventId": "86C37F50-950C-599D-B07A-88C0493784A9",
"eventVersion": 1,
"responseElements": {
"SlsProjectArn": "",
"EventRW": "Write",
"RequestId": "86C37F50-950C-599D-B07A-88C0493784A9",
"HomeRegion": "cn-hangzhou",
"OssKeyPrefix": "",
"OssBucketName": "tf-testaccactiontrail",
"SlsWriteRoleArn": "",
"OssWriteRoleArn": "acs:ram::118272523431****:role/aliyunactiontraildefaultrole",
"TrailRegion": "All",
"Name": "tf-testaccactiontrail"
},
"eventSource": "actiontrail.cn-hangzhou.aliyuncs.com",
"requestParameters": {
"AcsHost": "actiontrail.cn-hangzhou.aliyuncs.com",
"EventRW": "Write",
"AcsProduct": "Actiontrail",
"RequestId": "86C37F50-950C-599D-B07A-88C0493784A9",
"Region": "cn-hangzhou",
"OssBucketName": "tf-testaccactiontrail",
"OssWriteRoleArn": "acs:ram::118272523431****:role/aliyunactiontraildefaultrole",
"RegionId": "cn-hangzhou",
"HostId": "actiontrail.cn-hangzhou.aliyuncs.com",
"TrailRegion": "All",
"Name": "tf-testaccactiontrail"
},
"sourceIpAddress": "Internal",
"userAgent": "AlibabaCloud (linux; amd64) Golang/1.12.10 Core/0.01 TeaDSL/1 HashiCorp-Terraform/ Terraform-Provider/1.129.0 Terraform-Module/Default/LTAI****************:41d6e7ac-9fd7-4b05-b80d-9cf147e9fb4f",
"eventType": "ApiCall",
"referencedResources": {
"ACS::ActionTrail::Trail": [
"tf-testaccactiontrail"
]
},
"userIdentity": {
"accessKeyId": "LTAI****************",
"sessionContext": {
"attributes": {
"mfaAuthenticated": "false",
"creationDate": "2021-08-04T23:09:19Z"
}
},
"accountId": "118272523431****",
"principalId": "28544203916248****",
"type": "ram-user",
"userName": "Alice"
},
"serviceName": "Actiontrail",
"additionalEventData": {
"Scheme": "https",
"CallerBid": "26842"
},
"apiVersion": "2020-07-06",
"requestId": "86C37F50-950C-599D-B07A-88C0493784A9",
"eventTime": "2021-08-04T02:29:37Z",
"isGlobal": false,
"acsRegion": "cn-hangzhou",
"eventName": "UpdateTrail"
}Key fields in this example:
userIdentity.accessKeyId: the AccessKey ID used to make the API call. In this example, the value is LTAI.userIdentity.principalId: the ID of the account that owns the AccessKey pair. In this example, the value is28544203916248****.userIdentity.type: the identity type of the caller.ram-userindicates a RAM user.serviceName: the Alibaba Cloud service that generated the event.Actiontrailindicates ActionTrail.eventName: the name of the event.UpdateTrailindicates that a trail was modified.referencedResources: the resources involved in the event.{"ACS::ActionTrail::Trail": ["tf-testaccactiontrail"]}identifies thetf-testaccactiontrailtrail.acsRegion: the region where the event occurred.cn-hangzhouindicates the China (Hangzhou) region.eventTime: the time of the event in UTC.2021-08-04T02:29:37Zcorresponds to 10:29:37 on August 4, 2021 (UTC+8).
Modify a trail by assuming a RAM role
The caller is a RAM user who assumed a RAM role. In this example, a RAM user under account 189217171671**** assumed the trail-role role and modified the trail test-trail in the China (Hangzhou) region at 17:59:02 on August 5, 2021 (UTC+8). The role belongs to the same account 189217171671****.
{
"eventId": "C8E1ADC3-0DF3-5133-A40E-A0EE2B96A46A",
"eventVersion": 1,
"responseElements": {
"SlsProjectArn": "acs:log:cn-hangzhou:189217171671****:project/test-123",
"EventRW": "All",
"RequestId": "C8E1ADC3-0DF3-5133-A40E-A0EE2B96A46A",
"HomeRegion": "cn-hangzhou",
"OssKeyPrefix": "",
"OssBucketName": "",
"SlsWriteRoleArn": "acs:ram::189217171671****:role/aliyunserviceroleforactiontrail",
"OssWriteRoleArn": "",
"TrailRegion": "All",
"Name": "test-trail"
},
"eventSource": "actiontrail-openapi-share.cn-hangzhou.aliyuncs.com",
"requestParameters": {
"SlsLogStore": "actiontrail_test-trail",
"charset": "UTF-8",
"AcsHost": "actiontrail-openapi-share.cn-hangzhou.aliyuncs.com",
"RequestId": "C8E1ADC3-0DF3-5133-A40E-A0EE2B96A46A",
"HostId": "actiontrail-openapi-share.cn-hangzhou.aliyuncs.com",
"TrailRegion": "All",
"Name": "test-nnn",
"stsTokenPrincipalName": "trail-role/roleTest123",
"SlsProjectArn": "acs:log:cn-hangzhou:189217171671****:project/test-123",
"EventRW": "All",
"AcsProduct": "Actiontrail",
"OssKeyPrefix": "",
"AcceptLanguage": "zh-CN",
"Region": "cn-hangzhou",
"OssBucketName": "",
"stsTokenPlayerUid": 189217171671****
},
"sourceIpAddress": "Internal",
"userAgent": "actiontrail.console.aliyun.com",
"eventType": "ApiCall",
"referencedResources": {
"ACS::ActionTrail::Trail": [
"test-trail"
]
},
"userIdentity": {
"accessKeyId": "STS.****************",
"sessionContext": {
"attributes": {
"mfaAuthenticated": "false",
"creationDate": "2021-08-05T09:59:02Z"
}
},
"accountId": "189217171671****",
"principalId": "39484351102463****:roleTest123",
"type": "assumed-role",
"userName": "trail-role:roleTest123"
},
"serviceName": "Actiontrail",
"additionalEventData": {
"Scheme": "http",
"CallerBid": "26842"
},
"apiVersion": "2020-07-06",
"requestId": "C8E1ADC3-0DF3-5133-A40E-A0EE2B96A46A",
"eventTime": "2021-08-05T09:59:02Z",
"isGlobal": false,
"acsRegion": "cn-hangzhou",
"eventName": "UpdateTrail"
}Key fields in this example:
userIdentity.type: the identity type of the caller.assumed-roleindicates a RAM role.userIdentity.userName: identifies the caller in the format{roleName}:{sessionName}.roleNameis the assumed RAM role andsessionNameis the session name specified when assuming the role. In this example,trail-role:roleTest123meanstrail-roleis the role name androleTest123is the session name.requestParameters.stsTokenPlayerUid: the ID of the Alibaba Cloud account that owns the RAM user. In this example, the value is189217171671****.referencedResources: the resources involved in the event.{"ACS::ActionTrail::Trail": ["test-trail"]}identifies thetest-trailtrail.serviceName: the Alibaba Cloud service that generated the event.Actiontrailindicates ActionTrail.eventName: the name of the event.UpdateTrailindicates that a trail was modified.acsRegion: the region where the event occurred.cn-hangzhouindicates the China (Hangzhou) region.eventTime: the time of the event in UTC.2021-08-05T09:59:02Zcorresponds to 17:59:02 on August 5, 2021 (UTC+8).