ActionTrail will apply an updated declaration format of resource types to the referencedResources field in event logs that are delivered by trails created after 00:00:00 on December 1, 2020. After this change, the referencedResources field contains only the information in a format that is prefixed with ACS::. This change does not affect the events that are delivered by trails created before this change.

Description

Assume that you create Trail A before 00:00:00 on December 1, 2020 and Trail B after that time.

  • Before this change
    If you use Trail A to deliver an event, the referencedResources field in the event log contains both previous and updated declaration formats of resource types. For example, if you perform a specific operation on an Elastic Compute Service (ECS) instance, the referencedResources field in the event log is similar to the following example:
    referencedResources: {
       Instance: ["i-bp1fadfadf***"],
       "ACS::ECS::Instance": ["i-bp1fadfadf***"]
    }
    The referencedResources field contains the following information:
    • Instance: indicates that the operation is performed on an instance.
    • ACS::ECS::Instance: indicates that the operation is performed on an ECS instance.
    • InstanceId: the ID of the instance. In this example, the instance ID is recorded as i-bp1fadfadf***.
  • After this change

    If you use Trail B to deliver an event, the referencedResources field in the event log contains only the updated declaration format of resource types. If you use Trail A to deliver this event, the referencedResources field in the event log still contains both previous and updated declaration formats of resource types.

    Note If you use Trail B to deliver this event to a Log Service Logstore or an OSS bucket to which events were delivered before this change, the referencedResources field in the event log contains only the updated declaration format of resource types.
    referencedResources: {
       "ACS::ECS::Instance": ["i-bp1fadfadf***"]
    }
    The referencedResources field contains the following information:
    • ACS::ECS::Instance: indicates that the operation is performed on an ECS instance.
    • InstanceId: the ID of the instance. In this example, the instance ID is recorded as i-bp1fadfadf***.

Impacts

ActionTrail will update the declaration format of resource types for the referencedResources field only in event logs that are delivered by trails created after this change. The referencedResources field remains unchanged in event logs that are delivered by existing trails.

After this change, we recommend that you monitor and analyze events based on the updated declaration format of resource types that is prefixed with ACS::. This way, you can analyze events that are delivered by trails created before and after this change in a unified manner.

We apologize for any inconvenience caused by this change. We will speed up the upgrade and strive to provide you with more stable and robust audit services.