ActionTrail records all operations performed on your Alibaba Cloud account and resources over the last 90 days. You can query these records to monitor account activity, trace resource changes, and configure persistent log storage for compliance audits.
Why do you need operation auditing?
Operation auditing helps you maintain the security and compliance of your cloud assets:
Monitor account activity — ActionTrail records all access and modification operations on your account and resources, enabling you to quickly identify security events such as abnormal sign-ins and unauthorized operations.
Trace issues — When resources are modified or experience failures, you can reconstruct the operation chain to identify the responsible person, operation time, and source IP address.
Support compliance — ActionTrail meets the requirements of industry compliance standards for operation log retention and traceability, facilitating audits and compliance checks.
Key account security events
For a complete list of account sign-in events that ActionTrail can record, see Account sign-in events. The following event types are critical for account risk prevention and control.
| Event name | Description | Security risk and governance recommendation |
| ConsoleSignin | Account sign-in | Every sign-in is recorded in detail, including the time, IP address, and whether it was successful. Abnormal sign-ins, such as from unfamiliar locations or IP addresses, are often precursors to security incidents. Review sign-in records regularly. |
| PasswordModify/PasswordReset | Password modification or reset | Password changes directly affect account control. Operations not performed by the account owner can lead to account hijacking. Verify immediately. |
| MobileModify/EmailModify | Mobile number or email modification | Mobile numbers and email addresses are core credentials for account ownership. Any change may indicate account ownership risks. Enable change notifications. |
| MFABind/MFAUnbind | MFA binding or unbinding | MFA (multi-factor authentication) is a key measure for enhancing account security. Unbinding operations carry high risk and require close attention. |
| AccessKeyCreate/AccessKeyDelete | AccessKey creation or deletion | An AccessKey (AK) is a credential for programmatic access to cloud resources. The creation, deletion, or leakage of AKs can pose serious security risks. Perform regular inspections and minimize AK usage. |
(Recommended) Make the above events the focus of your security monitoring and alerting. Use the log analysis capabilities of ActionTrail to establish automated anomaly detection and response mechanisms, minimizing the risk of account intrusion or misoperation. For instructions, see Set up ActionTrail event alerts.
View account events in the ActionTrail console
ActionTrail is enabled by default and automatically records all operations in the last 90 days.
Log on to the ActionTrail consoleActionTrail console. In the left-side navigation pane, choose Events and click Event Query. On the top navigation bar, select Singapore as the region.
From the drop-down list, select Service Name and search for Cloud Account Sign-in Service. Select a time range. The console displays matching account sign-in event records.
View the details of specific sign-in events. Focus on the sign-in time, IP address, user agent, and other fields to determine whether the sign-in is abnormal. For more information about event field definitions, see ActionTrail event log fields.
Configure persistent log storage (optional)
If you need to retain logs beyond 90 days, create a trail to deliver logs to Object Storage Service (OSS) or Simple Log Service (SLS).
In the left-side navigation pane of the ActionTrail console, choose Trails and click Create Trail.
Enter a trail name, such as
account-management-events, and confirm the cost estimate to complete the creation.
NoteTrail event logs are stored in SLS, which incurs storage fees. For details, see ActionTrail billing.
After the configuration is complete, logs are automatically and permanently saved to the specified location. If you need to deliver logs to OSS or MaxCompute, click Create Trail.
FAQ
Is ActionTrail free?
Querying events in the last 90 days in the ActionTrail console is free.
If you create a trail to deliver logs to SLS or OSS, you pay only the storage fees for SLS or OSS.
What should I do if I find an unfamiliar IP address logged into my account?
Take the following actions immediately:
Change your password: Reset your Alibaba Cloud account password immediately. For instructions, see Reset your account password.
Enable MFA: Bind a virtual MFA device to your account for two-factor authentication during sign-in. After the binding is complete, even if your password is compromised again, attackers cannot complete the sign-in without the dynamic verification code from your MFA device. For instructions, see Configure MFA for your account.
Perform a comprehensive check: Use ActionTrail to check whether any other operations were performed during the sign-in from the suspicious IP address. Investigate whether any resources were maliciously created or modified.