What are the logon events of RAM users?-ActionTrail(ActionTrail)-阿里云帮助中心

When a RAM user logs on to the Alibaba Cloud Management Console, ActionTrail records a ConsoleSignin event. This topic provides sample event logs for three scenarios — MFA disabled, MFA enabled, and failed logon — and describes the key fields in each.

Successful logon without MFA

The following sample shows RAM user Alice logging on to the Alibaba Cloud Management Console at 08:00:00 on January 1, 2021 (UTC+8), with MFA disabled.

{
  "requestId": "1.167_1627549154939_339a",
  "eventType": "ConsoleSignin",
  "userIdentity": {
    "accountId": "159498693826****",
    "principalId": "23890260100229****",
    "type": "ram-user",
    "userName":  "Alice"
  },
  "acsRegion": "cn-hangzhou",
  "eventName": "ConsoleSignin",
  "eventSource": "signin.aliyun.com",
  "serviceName": "AasSub",
  "eventTime": "2021-01-01T00:00:00Z",
  "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.164 Safari/537.36",
  "eventId": "1.167_1627549154939_****",
  "additionalEventData": {
    "callbackUrl": "https://actiontrail.console.aliyun.com/cn-hangzhou/event-list?accounttraceid=******",
    "mfaChecked": "false"
  },
  "errorCode": "",
  "errorMessage": "",
  "eventVersion": "1",
  "sourceIpAddress": "192.168.XX.XX"
}

Key fields in this event log:

eventType: the event type. ConsoleSignin indicates a console logon event.
userIdentity.type: the identity type of the requester. ram-user indicates a RAM user.
userIdentity.userName: the username of the RAM user.
eventTime: the time the event was recorded, in UTC. 2021-01-01T00:00:00Z corresponds to 08:00:00 on January 1, 2021 (UTC+8).
additionalEventData.isMFAChecked: whether MFA was required for this logon. false indicates MFA was disabled.

Successful logon with MFA

The following sample shows RAM user Alice logging on to the Alibaba Cloud Management Console at 08:00:00 on January 1, 2021 (UTC+8), with MFA enabled.

{
  "requestId": "1.167_1627549154939_339a",
  "eventType": "ConsoleSignin",
  "userIdentity": {
    "accountId": "159498693826****",
    "principalId": "23890260100229****",
    "type": "ram-user",
    "userName":  "Alice"
  },
  "acsRegion": "cn-hangzhou",
  "eventName": "ConsoleSignin",
  "eventSource": "signin.aliyun.com",
  "serviceName": "AasSub",
  "eventTime": "2021-01-01T00:00:00Z",
  "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.164 Safari/537.36",
  "eventId": "1.167_1627549154939_****",
  "additionalEventData":{
    "callbackUrl": "https://actiontrail.console.aliyun.com/cn-hangzhou/event-list?accounttraceid=******",
    "mfaChecked": "true"
  },
  "errorCode": "",
  "errorMessage": "",
  "eventVersion": "1",
  "sourceIpAddress": "192.168.XX.XX"
}

Key fields in this event log:

eventType: the event type. ConsoleSignin indicates a console logon event.
userIdentity.type: the identity type of the requester. ram-user indicates a RAM user.
userIdentity.userName: the username of the RAM user.
eventTime: the time the event was recorded, in UTC. 2021-01-01T00:00:00Z corresponds to 08:00:00 on January 1, 2021 (UTC+8).
additionalEventData.isMFAChecked: whether MFA was required for this logon. true indicates MFA was enabled.

Failed logon

The following sample shows RAM user Alice failing to log on to the Alibaba Cloud Management Console at 08:00:00 on January 1, 2021 (UTC+8). The errorCode and errorMessage fields record the failure reason.

{
  "eventId": "1.167_1627549154939_****",
  "eventVersion": 1,
  "errorMessage": "Password is error",
  "eventSource": "signin.aliyun.com",
  "errorCode": "Authentication.Failed",
  "sourceIpAddress":"192.168.XX.XX",
  "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36",
  "eventType": "ConsoleSignin",
  "userIdentity": {
    "accountId": "159498693826****",
    "principalId": "23890260100229****",
    "type": "ram-user",
    "userName": "Alice"
  },
  "serviceName": "AasSub",
  "additionalEventData": {
    "callbackUrl": "https://actiontrail.console.aliyun.com/cn-hangzhou/event-list?accounttraceid=****",
    "mfaChecked": "false"
  },
  "requestId": "1.167_1627549154939_339a",
  "eventTime": "2021-01-01T00:00:00Z",
  "isGlobal": true,
  "acsRegion": "cn-hangzhou",
  "eventName": "ConsoleSignin"
}

Key fields in this event log:

errorCode: the error code. Authentication.Failed indicates the logon failed.
errorMessage: the error message. Password is error indicates the logon failed due to an incorrect password.
eventType: the event type. ConsoleSignin indicates a console logon event.
userIdentity.type: the identity type of the requester. ram-user indicates a RAM user.
userIdentity.userName: the username of the RAM user.
eventTime: the time the event was recorded, in UTC. 2021-01-01T00:00:00Z corresponds to 08:00:00 on January 1, 2021 (UTC+8).