ActionTrail will apply an updated declaration format of resource types to the referencedResources field in events from 00:00:00 on December 2, 2020. After this change, the referencedResources field contains only the information in a format that is prefixed with ACS::. This change does not affect the events that are delivered by trails that were created before this change.

Description

For example, you created Trail A before 00:00:00 on December 2, 2020 and Trail B after that time.

  • Before this change
    If you use Trail A to deliver an event after this change, the referencedResources field in the event contains both the previous and updated declaration formats of resource types. For example, if you perform a specific operation on an Elastic Compute Service (ECS) instance, the referencedResources field in the event is similar to the following example:
    referencedResources: {
       Instance: ["i-bp1fadfadf***"],
       "ACS::ECS::Instance": ["i-bp1fadfadf***"]
    }
    The referencedResources field contains the following information:
    • Instance: indicates that the operation is performed on an instance.
    • ACS::ECS::Instance: indicates that the operation is performed on an ECS instance.
    • InstanceId: the ID of the instance. In this example, the instance ID is recorded as i-bp1fadfadf***.
  • After this change

    If you use Trail B to deliver an event after this change, the referencedResources field in the event contains only the updated declaration format of resource types. If you use Trail A to deliver this event, the referencedResources field in the event still contains both the previous and updated declaration formats of resource types.

    Note If you use Trail B to deliver this event to a Log Service Logstore or an OSS bucket to which events were delivered before this change, the referencedResources field in the event contains only the updated declaration format of resource types.
    referencedResources: {
       "ACS::ECS::Instance": ["i-bp1fadfadf***"]
    }
    The referencedResources field contains the following information:
    • ACS::ECS::Instance: indicates that the operation is performed on an ECS instance.
    • InstanceId: the ID of the instance. In this example, the instance ID is recorded as i-bp1fadfadf***.

Impacts

ActionTrail will update the declaration format of resource types for the referencedResources field only in events that are delivered by trails created after this change. The referencedResources field remains unchanged in events that are delivered by existing trails.

After this change, we recommend that you monitor and analyze events based on the updated declaration format of resource types that is prefixed with ACS::. This way, you can analyze events that are delivered by trails created before and after this change in a unified manner.

We apologize for any inconvenience caused by this change. We will speed up the upgrade and strive to provide you with more stable and robust audit services.