Query events using role-based SSO-ActionTrail(ActionTrail)-阿里云帮助中心

During role-based single sign-on (SSO), you can call the AssumeRoleWithSAML operation to obtain a temporary identity for assuming a RAM role. The following sample event log shows a user querying ActionTrail events through role-based SSO, along with descriptions of the key fields.

Example

The following example shows an event that occurred at 14:05:24 on August 2, 2021 (UTC+8). In this event, a user assumed the testrole RAM role of the Alibaba Cloud account 159498693826**** to query ActionTrail events.

{
  "apiVersion": "2016-11-11",
  "requestId": "3462D6AF-4434-4690-8CAD-E54AED8B",
  "eventType": "ApiCall",
  "userIdentity": {
    "accessKeyId": "STS.NUQNP4PiGyckMsNiGELCs****",
    "sessionContext": {
      "attributes": {
        "mfaAuthenticated": "false",
        "creationDate": "2021-08-02T06:05:24Z"
      }
    },
    "accountId": "159498693826****",
    "principalId": "179432153826****:Alice@159498693826****.com",
    "type": "assumed-role",
    "userName": "testrole:Alice@159498693826****.com"
  },
  "acsRegion": "cn-shanghai",
  "eventName": "LookUpEvents",
  "requestParameters": {
    "stsTokenPrincipalName": "testrole:Alice@159498693826****.com",
    "AcsHost": "actiontrail.cn-hangzhou.aliyuncs.com",
    "ServiceCode": "actiontrail",
    "AcsProduct": "Actiontrail",
    "RequestId": "3462D6AF-4434-4690-8CAD-E54AED8B",
    "Region": "cn-hangzhou",
    "LookupAttribute.1.Value": "Write",
    "RegionId": "cn-hangzhou",
    "HostId": "actiontrail.cn-hangzhou.aliyuncs.com",
    "stsTokenPlayerUid": 10001,
    "LookupAttribute.1.Key": "EventRW"
  },
  "eventSource": "actiontrail.cn-hangzhou.aliyuncs.com",
  "serviceName": "Actiontrail",
  "eventTime": "2021-08-02T06:05:24Z",
  "userAgent": "",
  "eventId": "3462D6AF-4434-4690-8CAD-E54A****",
  "additionalEventData": {
    "Scheme": "https"
  },
  "errorCode": "",
  "errorMessage": "",
  "eventVersion": "1",
  "sourceIpAddress": "192.168.XX.XX"
}

The following list describes the key fields in the example:

userIdentity.accountId: The Alibaba Cloud account ID of the requester. The value 159498693826**** is the Alibaba Cloud account to which the RAM role belongs.
userIdentity.type: The identity type of the requester. The value assumed-role indicates a RAM role.
userIdentity.userName: The username of the requester. The format is {roleName}:{sessionName}, where roleName is the name of the assumed role and sessionName is the name specified for the role session. The value testrole:Alice@159498693826****.com indicates that the name of the assumed RAM role is testrole and the name specified for the role session is Alice@159498693826****.com.
userIdentity.attributes.creationDate: The time when the event occurred, in UTC. The value 2021-08-02T06:05:24Z corresponds to 14:05:24 on August 2, 2021 (UTC+8).