ApsaraDB for MongoDB:Enable the audit log feature

Scenarios

Prerequisites

• Log Service is activated. For more information, see Getting Started.

• If you want to enable the audit log feature as a Resource Access Management (RAM) user, you need to grant the following permissions to the RAM user:

  • AliyunLogFullAccess: This permission is a system policy. For more information about how to grant permissions to the RAM user, see Grant permissions to a RAM user.

  • dds:CheckServiceLinkedRole: This permission is a custom policy. You need to create a custom policy in the RAM console before you attach the policy to the RAM user. For more information about how to create a custom policy on the JSON tab, see Create custom policies. For more information about how to grant permissions to the RAM user, see Grant permissions to a RAM user.

    The following example shows the script of the dds:CheckServiceLinkedRole policy:

    {
    	"Version": "1",
    	"Statement": [
    		{
    			"Effect": "Allow",
    			"Action": "dds:CheckServiceLinkedRole",
    			"Resource": "*"
    		}
    	]
    }

• If you want to access audit logs as a RAM user, you need to grant the AliyunLogFullAccess or AliyunLogReadOnlyAccess permission to the RAM user. For more information about how to grant permissions to the RAM user, see Grant permissions to a RAM user.

Usage notes

• After you enable the audit log feature for an instance, ApsaraDB for MongoDB audits and logs the write operations that are performed on the instance. The instance may experience a performance decrease of 5% to 15% and specific amount of latency and jitter. The performance decrease, latency, and jitter vary with the amount of data that is written or audited.

  Note

  Your application may write a large amount of data to an instance. To prevent performance from decreasing in such scenarios, we recommend that you enable the audit log feature only for troubleshooting issues or auditing the security of the instance.

• By default, after the audit log feature is enabled, the selected operation types are admin and slow. For more information about how to change operation types, see Modify operation type for audit logs.

• The specified log retention period for an instance is applicable to the instance and all other instances that reside within the same region as the instance. Other operations are applicable only to the current instance.

• If you want to retain audit logs for a longer period of time or use larger storage space for audit logs during the free trial of this feature, you can upgrade the free trial edition to the official edition. For more information, see Upgrade to the official edition.

Billing rules

You are charged for the official edition based on the storage capacity and retention period of the audit logs. For more information about the pricing of the official edition, visit the Pricing tab of the ApsaraDB for MongoDB buy page.

You can also use the methods described in the following table to reduce fees incurred for audit logs.

Procedure

1. Log on to the ApsaraDB for MongoDB console.

2. In the left-side navigation pane, click Replica Set Instances or Sharded Cluster Instances.

3. In the upper-left corner of the page that appears, select the resource group and region to which the desired instance belongs.

4. Click the ID of the instance that you want to manage or click Manage in the Actions column.

5. In the left-side navigation pane of the instance details page, choose Data Security > Audit Logs.

6. On the Latest Audit Logs page, configure the Log Retention Period parameter.

   • The valid values of the parameter is 1 to 365. The default value is 30. The parameter is measured in days.

   • The specified log retention period for an instance is applicable to the instance and all other instances that reside within the same region as the instance. We recommend that you evaluate the retention period of audit logs for all instances within the same region before you configure the parameter.

7. Click Enable Audit Logs.

   Note

   When the audit log feature is enabled, ApsaraDB for MongoDB automatically obtains the AliyunServiceRoleForMongoDB role. This role allows ApsaraDB for MongoDB to use audit logs from Log Service.

8. In the Enable Audit Logs message, read the prompt and click OK.

Related tasks

Related operations

References

• View audit logs

• Download audit logs

• Disable the audit log feature