This topic describes how to view RAM operation records of a RAM user in the ActionTrail console. ActionTrail can record operations performed by Alibaba Cloud accounts and RAM users under the accounts. You can view records of operations performed by all RAM users under your Alibaba Cloud account.
Prerequisites
An Alibaba Cloud account is created. If not, create one before proceeding. To create an Alibaba Cloud account, click account registration page.
Procedure
Operations recorded by ActionTrail
ActionTrail can record the following RAM operations. For more information, see ActionTrail event log reference.
- Logon information of an Alibaba Cloud account or RAM user. For more information, see Console logon.
- Operations in the RAM console. The following is an example of a recorded operation:
{ "apiVersion":"2015-05-01", "eventId":"2cc52dee-d8d2-40c2-8de0-3a2cf1df****", "eventName":"DeleteGroup", "eventSource":"ram.aliyuncs.com", "eventTime":"2015-11-03T13:41:49Z", "eventType":"ApiCall", "eventVersion":"1", "requestId":"9AE24F49-C52C-4F0F-BCF9-9A4B8C22B147", "requestParameters":{ "GroupName":"grp1", }, "serviceName":"Ram", "sourceIpAddress":"42.120.XX.XX", "userAgent":"AliyunConsole", "userIdentity":{ "type":"ram-user", "principalId":"27418064654829****", "accountId":"123456789012****", "userName":"Alice", "sessionContext":{ "sessionAttributes":{ "creationDate":"2015-11-03T13:41:48Z", "mfaAuthenticated":"true" } } } }
- RAM and STS API operations called to create, change, or delete resources. The following
is an example of a recorded API operation:
{ "apiVersion": "2015-05-01", "eventId": "234ef3c7-8938-4bd7-bb80-11754b7b****", "eventName": "CreateGroup", "eventSource": "ram.aliyuncs.com", "eventTime": "2016-01-04T08:58:50Z", "eventType": "ApiCall", "eventVersion": "1", "recipientAccountId": "4****", "requestId": "1485748C-DB62-4693-AB7E-4BA3F3A970E1", "requestParameters": { "Comments": "this is a test group", "GroupName": "grp1" }, "serviceName": "Ram", "sourceIpAddress": "42.120.XX.XX", "userAgent": "aliyuncli/2.0.6", "userIdentity": { "type": "ram-user", "principalId": "27418064654829****", "accountId": "4****", "accessKeyId": "f6Iz********EI4d", "userName": "Alice" } }