DocsICP FilingConsole
Documentation
Home Page Key Management Service Key Management Service (KMS) Security Operations Simple Log Service for KMS Log fields

Log fields

Updated at:
Copy as MD
Product
My Favorites

This topic describes the fields in KMS access logs.

Field name

Description

Gateway used

Example

access_key_fingerprint
  • RAM identity: This field is not involved and is empty.
  • AAP identity: indicates the SM3 digest of the public key of the Client Key.

Dedicated gateway

sm3-8cf3a6ad2288597d8ba7dd93970403d22796c7c1a0ab6ee8cbe1380e18e****

access_key_id
  • RAM identity: indicates the AccessKey ID.
  • AAP identity: indicates the ID of the Client Key of the AAP.

Dedicated gateway

KAAP.38742edd-1992-4048-82fa-940b8a90****

account_id
  • RAM identity: indicates the UID of the Alibaba Cloud account that accesses the KMS instance.
  • AAP identity: indicates the UID of the Alibaba Cloud account to which the AAP belongs. If the AAP is not found, an error is returned and this field is empty.

Shared and dedicated gateways

119285303511****

api_name

KMS Instance API operation. For the full list, see Instance API overview.

Shared and dedicated gateways

GenerateDataKey

api_version

The version number of the Instance API.

Shared and dedicated gateways

dkms-gcs-0.2

client_ip

The IP address of the client.

Shared and dedicated gateways

192.168.XX.XX

cmkid

The ID of the requested key.

Shared gateway

key-phzz6a6075bb****

data_key_spec

The specification of the data key generated by API operations such as GenerateDataKey. For API operations that are not used to generate data keys, this field is empty.

Dedicated gateway

AES_256

domain_type

The type of the requested domain.

Shared gateway

Vpc

duration

The latency of request processing. Unit: milliseconds.

Shared and dedicated gateways

1.381

error_code

The error code. This field is empty if the request succeeds.

Shared gateway

Rejected.Disabled

error_message

The error message.

Shared and dedicated gateways

The ApiName "<apiname>" is invalid.

gateway_type

The gateway type, which is used to distinguish the source of logs. Valid values: dedicated (dedicated gateway) and shared (shared gateway).

Shared and dedicated gateways

dedicated

identity_type

The identity type. Valid values:

  • RAM:

    • cloud-account: Alibaba Cloud account.

    • ram-user: RAM user.

    • ram-role: RAM role.

  • AAP:

    aap: Client Key of an AAP.

Dedicated gateway

ram-user

instance_id

The ID of the KMS instance.

Shared and dedicated gateways

kst-gzz63ff0d55h5vdas****

key_spec

The specification of the key used for this cryptographic operation.

Dedicated gateway

AES_256

key_state

The status of the requested key.

Shared gateway

Enabled

key_version_id

The version ID of the requested key.

Shared gateway

key-phzz6a6075bb-w3ywop****

keyowner

The UID of the owner of the requested key.

Shared gateway

119285303511****

level

The log level. Only INFO is supported.

Dedicated gateway

INFO

mfaAuthenticated

Indicates whether multi-factor authentication (MFA) is used. Valid values: true and false.

Shared gateway

false

principal_id

  • RAM identity:

    • identity_type is cloud-account: UID of the Alibaba Cloud account.

    • identity_type is ram-user: UID of the RAM user.

    • identity_type is ram-role: UID of the RAM role.

  • AAP identity: If identity_type is aap, the name of the AAP. If the AAP is not found, an error is returned and this field is empty.

Shared and dedicated gateways

119285301584****

region_id

The region where the KMS instance resides.

Shared and dedicated gateways

cn-hangzhou

request

The request parameters.

Shared gateway

{"SecretName":""}

request_id

The request ID.

Shared and dedicated gateways

2753f2f4-efb8-49c8-9817-c60cfe286c2d

resource_id

The identifier of the resource, that is, the key ID or secret name.

Shared and dedicated gateways

key-hzz62f1cb66fa42qo****

resource_parameters

Other information about the resource, including the key version (key_version_id), the index ID in the hardware security module (HSM) (index), and the key ID (key_id).

Note

  • If the resource corresponding to resource_id is a secret, KeyId is the key used to encrypt the secret. If the resource corresponding to resource_id is a key, KeyId is the same as resource_id.

  • If the resource corresponding to resource_id is a key and the key is a hardware key, index has a valid value.

Dedicated gateway

{"key_id":"","key_version_id":"key-gzz64675a2ekoi4qj****-njscfe****","index":""}

secret_name

The name of the requested secret.

Shared gateway

share_gateway_api_name

This field has a valid value only when the request is initiated through a KMS service endpoint. The value corresponds to an OpenAPI operation. For more information, see OpenAPI overview.

Dedicated gateway

GenerateDataKey

status_code

The HTTP status code.

Shared and dedicated gateways

200

time

The time when the request starts to be processed. The value is in timestamp format.

Dedicated gateway

2023-07-04T01:52:55Z

tls_cipher_suite

The TLS cipher suite.

Shared gateway

ECDHE-RSA-AES128-GCM-SHA256

tls_version

The TLS protocol version.

Shared gateway

TLSv1.2

user_id

The UID of the Alibaba Cloud account to which the KMS instance belongs.

Dedicated gateway

119285303511****

useragent

The information about the client.

Dedicated gateway

AlibabaCloud (darwin; amd64) Golang/1.15.3 Core/0.01 TeaDSL/1

utc_time

The UTC time of the request. The value is in timestamp format.

Shared gateway

2026-09-17T08:44:29Z

version

The log version number.

Dedicated gateway

V1.0

vpc_id

The VPC ID when the request is initiated within a VPC.

Shared gateway

vpc-bp1****

Previous：Use Simple Log Service for KMSNext：Alert events