This topic describes how to record operations of an Alibaba Cloud account or a RAM user on resources by using ActionTrail.

Prerequisites

An Alibaba Cloud account is created. If not, create one before proceeding. To create an Alibaba Cloud account, click Create a new Alibaba Cloud account.

View RAM operations by using ActionTrail

  1. Log on to the ActionTrail console.
  2. On the History Search page, use the Filter drop-down list to search for the target event.
  3. Enter the user name, select Event Type and Time, and then click Search.
  4. Find the target event, then click +.
  5. Click View Event.

Operations recorded by ActionTrail

ActionTrail can record the following RAM operations:

  • Logon information of an Alibaba Cloud account or a RAM user. For more information, see ConsoleSignin event log examples.
  • Operations in the RAM console. The following is an example of a recorded operation event:
    {
        "apiVersion":"2015-05-01",
        "eventId":"2cc52dee-d8d2-40c2-8de0-3a2cf1df****",
        "eventName":"DeleteGroup",
        "eventSource":"ram.aliyuncs.com",
        "eventTime":"2015-11-03T13:41:49Z",
        "eventType":"ApiCall",
        "eventVersion":"1",
        "requestId":"9AE24F49-C52C-4F0F-BCF9-9A4B8C22B147",
        "requestParameters":{
            "GroupName":"grp1",
        },
        "serviceName":"Ram",
        "sourceIpAddress":"42.120.XX.XX",
        "userAgent":"AliyunConsole",
        "userIdentity":{
            "type":"ram-user",
            "principalId":"27418064654829****",
            "accountId":"123456789012****",
            "userName":"Alice",
            "sessionContext":{
                "sessionAttributes":{
                    "creationDate":"2015-11-03T13:41:48Z",
                    "mfaAuthenticated":"true"
                }
            }
        }
    }
    					
  • RAM and STS API calls for resource creation, change, and deletion. The following is an example of a recorded event:
    {
        "apiVersion": "2015-05-01",
        "eventId": "234ef3c7-8938-4bd7-bb80-11754b7b****",
        "eventName": "CreateGroup",
        "eventSource": "ram.aliyuncs.com",
        "eventTime": "2016-01-04T08:58:50Z",
        "eventType": "ApiCall",
        "eventVersion": "1",
        "recipientAccountId": "43274",
        "requestId": "1485748C-DB62-4693-AB7E-4BA3F3A970E1",
        "requestParameters": {
            "Comments": "this is a test group",
            "GroupName": "grp1"
        },
        "serviceName": "Ram",
        "sourceIpAddress": "42.120.XX.XX",
        "userAgent": "aliyuncli/2.0.6",
        "userIdentity": {
            "type": "ram-user",
            "principalId": "27418064654829****",
            "accountId": "43274",
            "accessKeyId": "f6Iz********EI4d",
            "userName": "Alice"
        }
    }