This topic describes the auditing features that Compute Nest provides for hosted O&M scenarios. You can use screen recording playback to review commands that a service provider runs on your resources and use resource operation logs to audit actions on your cloud resources. These features ensure transparency and security for all O&M operations.
Use cases
Compute Nest provides two main auditing methods:
-
Screen recording playback: When a service provider performs hosted O&M on an ECS instance, you can play back the session recording to review the executed commands.
-
Resource operation log auditing: You can review resource operation logs to track all operations that a service provider performs on your resources.
Prerequisites
-
The service provider has created a service that supports hosted O&M. For more information, see Create a hosted O&M service and Configure hosted O&M for a private deployment.
-
You have created the corresponding service instance and authorized the service provider to perform hosted O&M. For more information, see Create a hosted O&M service instance and Hosted O&M permissions.
Screen recording playback
How it works
-
When a service provider performs hosted O&M on an ECS instance, Workbench provides a screen recording playback feature. The customer and the service provider can each specify their own OSS bucket in the Compute Nest console to receive the recording files generated by Workbench.
-
Workbench sends the screen recording data to the OSS buckets of both the customer and the service provider. This allows both parties to access and view the screen recording directly through a Workbench link.
Step 1: Configure screen recording playback
Both service providers and customers can configure screen recording playback. This allows screen recordings of operations on ECS instances to be delivered to the OSS bucket in their respective accounts for traceability.
To view screen recordings, you must first configure screen recording playback.
Service provider configuration
-
Log on to the Compute Nest console.
-
In the left-side navigation pane, click Settings and find the Hosted O&M Settings section.
This section includes configuration items such as Hosted O&M access IP, Enable screen recording for remote connection, and Recording save path. Click Edit to modify the settings.
-
Configure the parameters as described in the table and click Save.
Parameter
Description
Hosted O&M Service IP
The IP address or CIDR block allowed for hosted O&M access. The value 0.0.0.0/0 allows access from any IP address.
Enable MFA
Specifies whether the O&M account requires MFA.
Screen Recording for Remote Connection
Specifies whether to enable screen recording for remote connections. If disabled, the service provider cannot view hosted O&M screen recordings.
OSS Bucket
The OSS bucket where screen recordings are stored.
Recording screen save path
The path within the OSS bucket where screen recordings are saved.
Record the length of the screen saver
The retention period for screen recordings. After this period, recordings are automatically deleted from the OSS bucket.
Customer configuration
-
Log on to the Compute Nest console.
-
In the left-side navigation pane, click Settings. In the Hosted O&M Settings section, click Edit.
-
Configure the parameters as described in the table and click Save.
You must also turn on the Deliver logs with ActionTrail switch. When enabled, this feature delivers audit logs for hosted O&M.
Parameter
Description
Screen Recording for Remote Connection
Specifies whether to enable screen recording for remote connections. If disabled, you cannot view hosted O&M screen recordings.
OSS Bucket
The OSS bucket where screen recordings are stored.
Recording screen save path
The path within the OSS bucket where screen recordings are saved.
Record the length of the screen saver
The retention period for screen recordings. After this period, recordings are automatically deleted from the OSS bucket.
Step 2: Perform hosted O&M
-
The service provider logs on to the ECS instance from the service instance details page.
In the left-side navigation pane, click Service instances. Find the target service instance and click the Resources tab. In the Actions column for the ECS instance, click remote connection.
-
Perform the required operations, and then close the connection.
[ecs-axxxx ~]$ ls a [ecs-axxxx ~]$
Step 3: View screen recording playback
Both the service provider and the customer can play back screen recordings from the service instance details page.
-
Go to the Screen Recording Playback tab of the service instance details page.
In the Actions column for the target ECS instance, click the ⋮ icon and select Screen recording playback from the drop-down menu.
-
On the Workbench audit and playback page, click Play to view the screen recording.
[ecs-assist xxx xxx]# ls xxx [ecs-assist xxx xxx]#
Resource operation log auditing
You can enable log delivery in the hosted O&M settings of Compute Nest. When this feature is enabled, it delivers logs of operations the service provider performs on your cloud resources to your account. This allows you to audit all hosted O&M activities.
-
Log on to the Compute Nest console.
-
In the left-side navigation pane, click Settings. In the Hosted O&M Settings section, click Edit and turn on Deliver logs with ActionTrail.
-
On the service instance details page, go to the Logs tab and select Resource Operation Logs. You can view the records of operations performed by the service provider on cloud resources in the service instance.
NoteIf the username is prefixed with
aliyuncomputenestsupplierroleforservice, the service provider performed the operation by assuming a hosted O&M role. You should focus your audit on these operations.Click Details in the Actions column for a log entry to view the operation details.