This topic describes how to view RAM operation records of a RAM user in the ActionTrail console. ActionTrail can record operations performed by Alibaba Cloud accounts and RAM users under the accounts. You can view records of operations performed by all RAM users under your Alibaba Cloud account.

Prerequisites

An Alibaba Cloud account is created. If not, create one before proceeding. To create an Alibaba Cloud account, click account registration page.

Procedure

  1. Log on to the ActionTrail console.
  2. On the History Search page, use the Filter drop-down list to search for the target event.
  3. Enter the username, select an Event Type and Time, and then click Search.
    Note You can also search for the target event by specifying the Event Name, Resource Type, Resource Name, and AccessKeyId.
  4. Find the target event, and then click+.
  5. Click View Event.

Operations recorded by ActionTrail

ActionTrail can record the following RAM operations. For more information, see ActionTrail event log reference.

  • Logon information of an Alibaba Cloud account or RAM user. For more information, see Console logon.
  • Operations in the RAM console. The following is an example of a recorded operation: 
    {
    "apiVersion":"2015-05-01",
    "eventId":"2cc52dee-d8d2-40c2-8de0-3a2cf1df****",
    "eventName":"DeleteGroup",
    "eventSource":"ram.aliyuncs.com",
    "eventTime":"2015-11-03T13:41:49Z",
    "eventType":"ApiCall",
    "eventVersion":"1",
    "requestId":"9AE24F49-C52C-4F0F-BCF9-9A4B8C22B147",
    "requestParameters":{
        "GroupName":"grp1",
    },
    "serviceName":"Ram",
    "sourceIpAddress":"42.120.XX.XX",
    "userAgent":"AliyunConsole",
    "userIdentity":{
        "type":"ram-user",
        "principalId":"27418064654829****",
        "accountId":"123456789012****",
        "userName":"Alice",
        "sessionContext":{
            "sessionAttributes":{
                "creationDate":"2015-11-03T13:41:48Z",
                "mfaAuthenticated":"true"
            }
        }
    }
}
  • RAM and STS API operations called to create, change, or delete resources. The following is an example of a recorded API operation: 
    {
    "apiVersion": "2015-05-01",
    "eventId": "234ef3c7-8938-4bd7-bb80-11754b7b****",
    "eventName": "CreateGroup",
    "eventSource": "ram.aliyuncs.com",
    "eventTime": "2016-01-04T08:58:50Z",
    "eventType": "ApiCall",
    "eventVersion": "1",
    "recipientAccountId": "4****",
    "requestId": "1485748C-DB62-4693-AB7E-4BA3F3A970E1",
    "requestParameters": {
        "Comments": "this is a test group",
        "GroupName": "grp1"
    },
    "serviceName": "Ram",
    "sourceIpAddress": "42.120.XX.XX",
    "userAgent": "aliyuncli/2.0.6",
    "userIdentity": {
        "type": "ram-user",
        "principalId": "27418064654829****",
        "accountId": "4****",
        "accessKeyId": "f6Iz********EI4d",
        "userName": "Alice"
    }
}