All Products
Search
Document Center

Resource Orchestration Service:ALIYUN::ACTIONTRAIL::Trail

Last Updated:Mar 12, 2024

ALIYUN::ACTIONTRAIL::Trail is used to create a trail to deliver events to Simple Log Service or Object Storage Service (OSS).

Syntax

{
  "Type": "ALIYUN::ACTIONTRAIL::Trail",
  "Properties": {
    "Name": String,
    "OssBucketName": String,
    "RoleName": String,
    "OssKeyPrefix": String,
    "EventRW": String,
    "SlsProjectArn": String,
    "SlsWriteRoleArn": String
  }
}            

Properties

Property

Type

Required

Editable

Description

Constraint

Name

String

Yes

No

The trail name.

The name must be 6 to 36 characters in length. The name must start with a letter and can contain letters, digits, hyphens (-), and underscores (_).

Note

The name must be unique within an Alibaba Cloud account.

OssBucketName

String

No

Yes

The name of the OSS bucket to which you want to deliver events.

The name must be 3 to 63 characters in length. The name must start with a lowercase letter or a digit and can contain lowercase letters, digits, and hyphens (-).

Note
  • Make sure that an OSS bucket is created. For more information, see Create buckets.

  • You must specify at least one of OssBucketName and SlsProjectArn.

RoleName

String

No

Yes

The service-linked role that is assumed by ActionTrail.

Default value: AliyunServiceRoleForActionTrail.

OssKeyPrefix

String

No

Yes

The name prefix of objects where you want to store delivered events in the OSS bucket.

The prefix must be 6 to 32 characters in length. The prefix must start with a letter and can contain letters, digits, hyphens (-), forward slashes (/), and underscores (_).

EventRW

String

No

Yes

The read/write type of the events that you want to deliver.

Valid values:

  • Read: read

  • Write (default): write

  • All: read and write

SlsProjectArn

String

No

Yes

The Alibaba Cloud Resource Name (ARN) of the Simple Log Service project to which you want to deliver events.

Make sure that a project and a Logstore of Simple Log Service are created. You must specify the name of a Logstore in the following format: actiontrail_<Trail name>.

For more information, see Create a project and Create a Logstore.

Note

You must specify at least one of OssBucketName and SlsProjectArn.

SlsWriteRoleArn

String

No

Yes

The ARN of the role that is assumed by ActionTrail to deliver events to the Simple Log Service project.

None.

Return values

Fn::GetAtt

Name: the trail name.

Examples

  • YAML format

    ROSTemplateFormatVersion: '2015-09-01'
    Parameters: {}
    Resources:
      Role:
        Type: ALIYUN::RAM::Role
        Properties:
          RoleName: TestRole
          Policies:
            - PolicyName:
                Fn::Sub: ActionTrailPolicy-${ALIYUN::StackId}
              PolicyDocument:
                Version: '1'
                Statement:
                  - Action:
                      - oss:GetBucketLocation
                      - oss:ListObjects
                      - oss:PutObject
                    Resource:
                      - '*'
                    Effect: Allow
                  - Action:
                      - log:PostLogStoreLogs
                      - log:CreateLogstore
                      - Log:GetLogstore
                    Resource:
                      - '*'
                    Effect: Allow
                  - Action:
                      - mns:PublishMessage
                    Resource:
                      - '*'
                    Effect: Allow
          AssumeRolePolicyDocument:
            Version: '1'
            Statement:
              - Action: sts:AssumeRole
                Effect: Allow
                Principal:
                  Service:
                    - actiontrail.aliyuncs.com
      Bucket:
        Type: ALIYUN::OSS::Bucket
        Properties:
          AccessControl: private
          BucketName: MyTestBucket
          DeletionForce: true
      SlsProject:
        Type: ALIYUN::SLS::Project
        Properties:
          Name: DemoSls
      SlsLogStore:
        Type: ALIYUN::SLS::Logstore
        DependsOn: SlsProject
        Properties:
          LogstoreName: ActiontrailTestTrail
          PreserveStorage: true
          ProjectName:
            Fn::GetAtt:
              - SlsProject
              - Name
          AppendMeta: true
          MaxSplitShard: 64
          AutoSplit: true
          EnableTracking: false
          ShardCount: 2
      Trail:
        DependsOn:
          - Role
          - Bucket
          - SlsLogStore
        Type: ALIYUN::ACTIONTRAIL::Trail
        Properties:
          SlsProjectArn:
            Fn::Sub: acs:log:${ALIYUN::Region}::project/DemoSls
          RoleName:
            Fn::GetAtt:
              - Role
              - RoleName
          EventRW: All
          OssKeyPrefix: TestFile
          OssBucketName:
            Fn::GetAtt:
              - Bucket
              - Name
          SlsWriteRoleArn:
            Fn::Sub: acs:ram::${ALIYUN::TenantId}:role/${Role.RoleName}
          Name: TestTrail
      TrailLogging:
        Type: ALIYUN::ACTIONTRAIL::TrailLogging
        Properties:
          Name:
            Fn::GetAtt:
              - Trail
              - Name
          Enable:
            Ref: Enable
    Outputs:
      Name:
        Value:
          Fn::GetAtt:
            - Trail
            - Name
  • JSON format

    {
      "ROSTemplateFormatVersion": "2015-09-01",
      "Parameters": {
      },
      "Resources": {
        "Role": {
          "Type": "ALIYUN::RAM::Role",
          "Properties": {
            "RoleName": "TestRole",
            "Policies": [
              {
                "PolicyName": {
                  "Fn::Sub": "ActionTrailPolicy-${ALIYUN::StackId}"
                },
                "PolicyDocument": {
                  "Version": "1",
                  "Statement": [
                    {
                      "Action": [
                        "oss:GetBucketLocation",
                        "oss:ListObjects",
                        "oss:PutObject"
                      ],
                      "Resource": [
                        "*"
                      ],
                      "Effect": "Allow"
                    },
                    {
                      "Action": [
                        "log:PostLogStoreLogs",
                        "log:CreateLogstore",
                        "Log:GetLogstore"
                      ],
                      "Resource": [
                        "*"
                      ],
                      "Effect": "Allow"
                    },
                    {
                      "Action": [
                        "mns:PublishMessage"
                      ],
                      "Resource": [
                        "*"
                      ],
                      "Effect": "Allow"
                    }
                  ]
                }
              }
            ],
            "AssumeRolePolicyDocument": {
              "Version": "1",
              "Statement": [
                {
                  "Action": "sts:AssumeRole",
                  "Effect": "Allow",
                  "Principal": {
                    "Service": [
                      "actiontrail.aliyuncs.com"
                    ]
                  }
                }
              ]
            }
          }
        },
        "Bucket": {
          "Type": "ALIYUN::OSS::Bucket",
          "Properties": {
            "AccessControl": "private",
            "BucketName": "MyTestBucket",
            "DeletionForce": true
          }
        },
        "SlsProject": {
          "Type": "ALIYUN::SLS::Project",
          "Properties": {
            "Name": "DemoSls"
          }
        },
        "SlsLogStore": {
          "Type": "ALIYUN::SLS::Logstore",
          "DependsOn": "SlsProject",
          "Properties": {
            "LogstoreName": "ActiontrailTestTrail",
            "PreserveStorage": true,
            "ProjectName": {
              "Fn::GetAtt": [
                "SlsProject",
                "Name"
              ]
            },
            "AppendMeta": true,
            "MaxSplitShard": 64,
            "AutoSplit": true,
            "EnableTracking": false,
            "ShardCount": 2
          }
        },
        "Trail": {
          "DependsOn": [
            "Role",
            "Bucket",
            "SlsLogStore"
          ],
          "Type": "ALIYUN::ACTIONTRAIL::Trail",
          "Properties": {
            "SlsProjectArn": {
              "Fn::Sub": "acs:log:${ALIYUN::Region}::project/DemoSls"
            },
            "RoleName": {
              "Fn::GetAtt": [
                "Role",
                "RoleName"
              ]
            },
            "EventRW": "All",
            "OssKeyPrefix": "TestFile",
            "OssBucketName": {
              "Fn::GetAtt": [
                "Bucket",
                "Name"
              ]
            },
            "SlsWriteRoleArn": {
              "Fn::Sub": "acs:ram::${ALIYUN::TenantId}:role/${Role.RoleName}"
            },
            "Name": "TestTrail"
          }
        },
        "TrailLogging": {
          "Type": "ALIYUN::ACTIONTRAIL::TrailLogging",
          "Properties": {
            "Name": {
              "Fn::GetAtt": [
                "Trail",
                "Name"
              ]
            },
            "Enable": {
              "Ref": "Enable"
            }
          }
        }
      },
      "Outputs": {
        "Name": {
          "Value": {
            "Fn::GetAtt": [
              "Trail",
              "Name"
            ]
          }
        }
      }
    }