Create a multi-account trail

Procedure

1. Log on to the ActionTrail console by using the delegated administrator account or the management account of your resource directory.
   For more information about how to specify a delegated administrator account, see Manage a delegated administrator account.
2. In the left-side navigation pane, click Trails.
3. In the top navigation bar, select the region in which you want to create a multi-account trail.
   Note The region that you select becomes the home region of the trail that you want to create.
4. On the Trails page, click Create Trail.
5. In the Trail Basic Settings step, set the parameters that are described in the following table and click Next.

   Parameter	Description
   Trail Name	The name of the trail that you want to create. The name must be unique within your Alibaba Cloud account. If you specify that events are to be delivered to Log Service, the trail name is used to name the Logstore that is used to store events. Specify the name in the format of actiontrail_<Trail name>.
   Log Event	The category of event that you want to deliver. By default, Management Event is selected. The system delivers user-initiated events that record the management operations performed on cloud resources. You can select the type of user-initiated event that you want to deliver. Valid values: All Events: all read and write events. All events must be recorded for auditing, as stipulated in the auditing-related regulations and standards. We recommend that you select All Events. Write: the events that record the operations to create, delete, or modify cloud resources. For example, a CreateInstance event is generated when a subscription or pay-as-you-go Elastic Compute Service (ECS) instance is created. If you need to export events only for analysis and focus on only the events that affect the O&M of cloud resources, select Write. Read: the events that record the operations to read information about cloud resources, rather than to create, delete, or modify cloud resources. For example, a DescribeInstances event is generated when the details of one or more ECS instances are queried. Read events are often generated in abundance and occupy large storage space. However, all events must be recorded for auditing, as stipulated in the auditing-related regulations and standards. We recommend that you configure the trail to deliver both read and write events. This helps you track the use of AccessKey pairs and access to cloud resources. Note By default, when you create a trail in the ActionTrail console, the system assumes that the trail delivers events in all regions. To create a trail that delivers events in specific regions, call the CreateTrail operation. Set the TrailRegion parameter as needed when you call this operation.
   Apply Trail to All Members	Specifies whether to apply the trail to all members in the resource directory. Valid values: Yes: If you select this option, the trail delivers the events of the management account and all members in the resource directory to the specified OSS bucket or Log Service Logstore. To ensure that all events are delivered, we recommend that you select this option. No: If you select this option, the trail delivers only the events of the management account to the specified OSS bucket or Log Service Logstore. In this case, a single-account trail is created. Note This parameter cannot be modified once set. To modify the Apply Trail to All Members setting, you must delete the existing multi-account trail and create another one. After you create a multi-account trail, the setting of the Apply Trail to All Members parameter is displayed in the Created By column on the Trails page. If you select Yes for the Apply Trail to All Members parameter, the type of the trail is displayed as Multi-account Trail in the Trail Type column after the trail is created. If you select No for the Apply Trail to All Members parameter, the type of the trail is displayed as Single-account Trail in the Trail Type column after the trail is created.

6. In the Event Delivery Settings step, specify one or more delivery destinations and click Next.
   You can create a trail to deliver events to Log Service, OSS, or both. For more information about how to select a storage service, see Deliver events to specified Alibaba Cloud services.

   Note The events generated after the multi-account trail takes effect are delivered. The events generated in the last 90 days are excluded. To meet your requirements to the greatest extent possible, you can create a historical event delivery task to deliver the events generated in the last 90 days to the delivery destination that you specify for the trail at a time. For more information, see Create a historical event delivery task.

   • Select Delivery to Log Service
     • If you select Delivery to Current Account, set the parameters that are described in the following table.

       Parameter	Description
       Logstore Region	The region in which the Log Service project resides.
       Project Name	The name of the Log Service project. The project name must be unique within the current Alibaba Cloud account. If you select New Log Service Project, ActionTrail creates a project with the name that you specify and creates a Logstore in the project. If you select Existing Log Service Project, you must select an existing project from the Project Name drop-down list. Note After you create a trail to deliver events to Log Service, a Logstore named in the actiontrail_<Trail name> format is created. This Logstore is automatically configured for subsequent auditing. To be specific, indexes and a dashboard are created for the Logstore to facilitate event queries. In addition, you are not allowed to manually write data to the Logstore. This ensures data integrity. You do not need to create a Logstore in advance.

     • If you select Delivery to Another Account, set the Log Service Project ARN and RAM Role ARN of Destination Account parameters.

       To deliver events to another account, you must create a RAM role by using the destination account, grant ActionTrail the permissions to deliver events to the destination account, and then create a Log Service project before you create the trail. For more information, see Aggregate events across members in a resource directory.

   • Select Delivery to OSS
     • If you select Delivery to Current Account, set the parameters that are described in the following table.

       Parameter	Description
       Bucket Name	The name of the OSS bucket. The bucket name must be unique within the current Alibaba Cloud account. If you select New OSS Bucket, ActionTrail creates an OSS bucket with the name that you specify. If you select Existing OSS Bucket, you must select an existing bucket from the Bucket Name drop-down list. Notice You must complete real-name registration on the Real-name Registration page before you create a bucket in a region within the Chinese mainland.
       Log File Prefix	The prefix of the names of the OSS objects in which the delivered events are stored. The prefix helps you find the events in subsequent operations.
       Server Encryption	Specifies whether and how to encrypt objects in the OSS bucket. If you select New OSS Bucket, you must set the parameter. Valid values: Fully Managed by OSS KMS No Note For more information about the server-side encryption feature of OSS, see Server-side encryption.

     • If you select Delivery to Another Account, set the RAM Role ARN of OSS Bucket, Bucket Name, and Log File Prefix parameters.

       To deliver events to another account, you must create a RAM role by using the destination account, grant ActionTrail the permissions to deliver events to the destination account, and then create an OSS bucket before you create the trail. For more information, see Aggregate events across members in a resource directory.

7. In the Preview and Create step, confirm the trail information and click Submit.

What to do next

After you create a multi-account trail, the trail delivers events to the OSS bucket or Log Service Logstore that you specify in the JSON format for query and analysis. You can view the events that are stored in the OSS bucket or Log Service Logstore by using the management account.

• Query events in the Log Service console: ActionTrail automatically creates a Logstore named in the format of actiontrail_<Trail name>. To query and analyze events in the Log Service console, go to the Trails page of the ActionTrail console first. Find the trail that you created, move the pointer over the icon in the Storage Service column, and then click the name of the Logstore.
• Query events in the OSS console: Global events that are generated within members are delivered together with the events that are generated in the home region of the trail. Non-global events that are generated for the resources in a specific region are delivered to the corresponding storage paths with the specific region ID. You can analyze the events by using E-MapReduce (EMR) or a third-party log analysis service.

  To query and analyze events in the OSS console, go to the Trails page of the ActionTrail console first. Find the trail that you created, move the pointer over the icon in the Storage Service column, and then click the name of the OSS bucket. On the bucket overview page, click Files in the left-side navigation pane. For more information about the storage paths in OSS, see What is the storage path of an event that is delivered to an OSS bucket?