All Products
Search

This Product

    Container Registry:Instance Audit

    Document Center

    Container Registry:Instance Audit

    Last Updated:Jun 20, 2026

    The instance audit feature enables you to track and analyze instance usage in ACR to enhance security and control. This topic describes how to enable instance audit and provides detailed explanations of the log fields.

    Prerequisites

    Enable and view instance audit

    After enabling instance audit, you can select push or pull logs based on a time period. This helps you monitor and analyze user activity in real time to enhance security, support compliance, and troubleshoot issues quickly.

    1. Log on to the Container Registry console.

    2. In the top navigation bar, select a region.

    3. In the left-side navigation pane, click Instances.

    4. On the Instances page, click the Enterprise Edition instance that you want to manage.

    5. In the navigation pane on the left of the instance management page, select Instances > Audit Center, then click the Instance Audit tab, and finally click Enable.

      Note

      • The console creates a project named aliyun-product-data-<UID>-<region> in Simple Log Service and a Logstore named acr_access_log.

      • Logs from multiple instances in the same region are stored in the same Logstore. Use the instance ID to filter logs.

      • The default data retention period is 365 days. You can modify it in Simple Log Service as needed. For more information, see Manage a Logstore.

    Audit field details

    The following is a detailed description of instance audit fields.

    Field name

    Example

    Description

    access_credential_type

    Password

    Credential type.

    • Password: fixed password.

    • TemporaryToken: temporary token.

    action

    GetImageManifest

    Operation type.

    • GetImageManifest: get image manifest.

    • GetBlob: get image BLOB.

    • PutImageManifest: push image manifest.

    • DeleteTag: delete image version.

    blob_digest

    sha256:4f4fxxxx

    A unique identifier generated from the hash of the BLOB content.

    http_request_host

    demo-registry.cn-hangzhou.cr.aliyuncs.com

    Request endpoint.

    http_request_id

    718e09d1-aab5-xxxxx

    Request ID.

    http_request_method

    GET

    HTTP request method.

    http_request_remote_vpc_id

    vpc-xxxxxx

    Client VPC address.

    http_request_remoteaddr

    140.xx.xx.xx

    Client IP address.

    http_request_useragent

    docker/24.0.2

    HTTP User-Agent header.

    http_response_status

    200

    HTTP response status code.

    instance_id

    cri-xxx

    Instance ID.

    namespace

    test-ns

    Image namespace.

    repo

    test-repo

    Image repository name.

    namespace_repo

    test-ns/test-repo

    Full image repository name.

    network_type

    Internet

    Network type.

    • Internet: public network.

    • VPC: virtual private cloud (VPC).

    tag

    v1

    Image version.

    time

    2024-04-12T16:58:30.855892463+08:00

    Time when the server received the request.

    user_identity_account_id

    135668xxxxxxx

    Alibaba Cloud account ID of the requester.

    user_identity_player_account_id

    149134xxxxxxx

    Account ID of the role assumer.

    user_identity_principal_id

    300786xxxxxxx:Alice

    Requester ID. Use this field together with user_identity_user_type to uniquely identify the requester.

    • If the type is root-account, the Alibaba Cloud account ID is recorded.

    • If the type is ram-user, the RAM user ID is recorded.

    • If the type is assumed-role, RoleID:RoleSessionName is recorded.

    user_identity_role_id

    300786xxxxxxx

    Role ID.

    user_identity_role_name

    teststs

    Role name.

    user_identity_user_type

    assumed-role

    Identity type.

    • root-account: Alibaba Cloud account.

    • ram-user: RAM user.

    • assumed-role: RAM role.

    • system: ACR service invocation.

    user_name

    sub_user@xxxx

    Instance logon name.