ActionTrail provides system templates in the advanced event query feature for querying key status changes and operations throughout resource lifecycles, such as WAF instance creation and deletion, KMS certificate deletion, and RAM role creation and deletion. The following example shows how to query a KMS master key creation event.
Prerequisites
A trail is created, and events are delivered to Simple Log Service. For more information, see Create a single-account trail and Create a multi-account trail.
Procedure
-
Log on to the ActionTrail console.
-
In the left-side navigation pane, choose .
-
In the Query Range section, select the trail that you created from the trail drop-down list.
-
In the Query Range section, on the Template Library tab, choose .
NoteYou can configure up to 30 query conditions at a time.
-
On the Resource Lifecycle Events tab, specify a time range for the events, and then click Run.
Note-
By default, ActionTrail queries events from the past seven days.
-
Click Event Alerting on the right to configure an alert for the current query. Create a custom alert rule.
-
Modify the default SQL statement in the system template, then click Save to save it as a custom template.
-
-
View the query results.
-
Raw Log
On the Raw Logs tab, find the event you want to view and click View Event Details in the Actions column to see the basic information and the event record.
NoteThe View Event Details panel shows that a RAM user created a key at 15:35:58 on January 16, 2024 in the China (Hangzhou) region.
-
Query histogram: On the query histogram tab, view the event histogram.
-
References
You can also query event details by using custom query conditions or SQL statements. For more information, see Perform custom event queries.