A trail delivers events from cloud services to an Object Storage Service (OSS) bucket or a Simple Log Service Logstore for long-term storage and analysis. By default, ActionTrail records only the last 90 days of events. You can query the events in the ActionTrail console. To query events that are generated more than 90 days ago, you must create a trail.
How it works
The following figure shows how trails work.
Use scenarios
Trails collect audit logs in a central location for extended periods. These logs support security monitoring, compliance audits, fault diagnosis, and resource change tracking.
-
Security monitoring and assurance
-
Suspicious event detection: Monitor unusual API calls or requests from unexpected locations to detect security threats or unauthorized access.
-
User behavior analysis: Analyze user behavior patterns in audit logs to detect unusual operations.
-
Permission change tracking: Monitor changes to RAM policies and permissions through multi-account trails to ensure only authorized users perform critical operations.
-
-
Compliance audit
-
Operation log retention: To comply with legal and regulatory requirements, enterprises may need to retain operation logs for extended periods. A multi-account trail stores these logs in OSS for future review.
-
Compliance report: Generate compliance reports from delivered data to verify adherence to security standards and policies.
-
-
Resource change management
-
Resource lifecycle management: Record resource creation, modification, and deletion events to manage the full resource lifecycle.
-
Environmental change audit: Use multi-account trails to record who changed the environment and when, helping ensure environment stability.
-
-
Troubleshooting and O&M
-
Service failure analysis: Analyze operations before and after a service interruption or performance degradation to identify root causes.
-
Configuration change tracking: Record all cloud resource configuration changes to identify errors that may cause service interruptions.
-
Terms
|
Concepts |
Description |
|
Trail |
A configuration that delivers events to an OSS bucket or Simple Log Service Logstore for storage and analysis. ActionTrail supports single-account trails, multi-account trails, and trails for the Inner-ActionTrail feature. These types differ in creator, effective scope, and delivery content. |
|
single-account trail |
An individual user can create a single-account trail to deliver events to Simple Log Service or OSS. An individual user can create multiple single-account trails to:
|
|
multi-account trail |
After an enterprise user creates a resource directory, the management account of the resource directory can create a multi-account trail to deliver events from all members to a Simple Log Service Logstore or OSS bucket. |
|
Platform audit trail |
An individual user can create a trail for the Inner-ActionTrail feature to deliver events generated by Alibaba Cloud O&M team activities on your services to a Simple Log Service Logstore. |
|
management account |
A management account is used to enable a resource directory and serves as the super administrator of the resource directory. The management account has all administrative permissions over the directory and its members. Only an Alibaba Cloud account with enterprise real-name verification can serve as a management account. Each resource directory has one management account. |
|
member |
A resource container and organizational unit in a resource directory, representing a project or application. Resources are isolated between members. The management account grants RAM users, user groups, or RAM roles access to member resources. Members can be invited to a resource directory or created by the management account. |
|
delegated administrator account |
The management account can designate a member as a delegated administrator for a trusted service. The designated member can then access resource directory information, including its structure and members, and manage business within the resource directory. |
Single-account vs. multi-account trails
|
Trail Type |
Creator |
Event scope |
Query methods |
Limit |
How to create |
|
Single-account trail |
Alibaba Cloud account |
Events of an Alibaba Cloud account |
|
Five in a region |
|
|
multi-account trail |
Delegated administrator account or management account |
Events of all members |
Delegated administrator account or management account:
|
One in all regions |