This document describes how ActionTrail integrates with Object Storage Service (OSS) to audit data events. ActionTrail records data events for OSS operations and delivers them to a Logstore in Log Service (SLS). You can then query and analyze these events in real time for compliance auditing, issue tracing, and security analysis.
ActionTrail does not support recording or delivering data events for OSS in Finance Cloud regions.
ActionTrail records data events for operations on cloud resources performed through API calls, the console, or other methods. The following table lists the auditable data events for OSS. This list will be updated as more events are supported.
Event name | Description |
GetBucket (ListObjects/ListObjectsV2) | Lists the objects in a bucket. |
ListObjectVersions | Lists all versions of objects, including delete markers. |
PutObject | Uploads an object. |
GetObject | Retrieves an object. |
CopyObject | Copies an object or changes its storage class. |
AppendObject | Uploads an object by appending data. |
DeleteObject | Deletes an object. |
DeleteMultipleObjects | Deletes multiple objects in a single request. |
GetObjects | Retrieves multiple objects in a single request. |
CopyObjects | Copies multiple objects in a single request. |
HeadObject | Retrieves object metadata by using the HEAD method. |
GetObjectMeta | Retrieves object metadata. |
PostObject | Uploads an object by using an HTML form post. |
RestoreObject | Restores an object from Archive, Cold Archive, or Deep Cold Archive storage. |
CleanRestoredObject | Deletes the restored copy of an object. |
SelectObject | Runs an SQL query on a CSV or JSON object and returns the result. |
CreateSelectObjectMeta | Creates and retrieves metadata for a target object, such as the number of rows, columns, and data blocks. |
InitiateMultipartUpload | Initiates a multipart upload. |
UploadPart | Uploads a part in a multipart upload. |
UploadPartCopy | Uploads a part by copying data from an existing object. |
CompleteMultipartUpload | Completes a multipart upload by assembling the uploaded parts. |
AbortMultipartUpload | Aborts a multipart upload and deletes any uploaded parts. |
ListMultipartUpload | Lists all in-progress multipart uploads. |
ListParts | Lists the parts that have been uploaded for a specific multipart upload. |
StartPartUpload | Starts a chunked upload process for a part. |
UploadPartChunk | Uploads a chunk of a part. |
CommitPart | Commits the uploaded chunks to form a part. |
PutObjectLink | Creates a link object. |
GetObjectLink | Retrieves a link object. |
PostObjectGroup | Creates a group object. |
GetGroupIndex | Queries a group object. |
GetObjectInfo | Retrieves information about a specified object. |
PutSymlink | Creates a symbolic link for a target object. |
GetSymlink | Reads a specified symbolic link. |
PutObjectAcl | Sets or modifies the ACL of an object. |
GetObjectAcl | Retrieves the ACL of an object. |
PutObjectTagging | Sets or updates the tags for an object. |
GetObjectTagging | Retrieves the tags for an object. |
DeleteObjectTagging | Removes all tags from an object. |
PutLiveChannel | Creates a LiveChannel and returns its ingest and playback URLs. |
GetLiveChannelInfo | Retrieves the configuration of a specified LiveChannel. |
ListLiveChannel | Lists the LiveChannels in a bucket. |
DeleteLiveChannel | Deletes a specified LiveChannel. |
GetLiveChannelStat | Retrieves the ingest status of a specified LiveChannel. |
PutLiveChannelStatus | Enables or disables a specified LiveChannel. |
GetLiveChannelHistory | Retrieves the stream ingestion history for a specified LiveChannel. |
GetVodPlaylist | Retrieves the VOD playlist generated from a LiveChannel stream within a specified time range. |
PostVodPlaylist | Generates a VOD playlist for a specified LiveChannel. |
PostAsyncFetchTask | Submits an asynchronous file fetch task. |
GetAsyncFetchTask | Queries an asynchronous file fetch task. |
PostDataLakeStorageFileOperation | Accesses files by using the OSS-HDFS service. |
DoMetaQuery | Queries for objects that match specified conditions by using data indexes. |
WriteGetObjectResponse | Writes a custom response to a GetObject request. |
ProcessImm | Processes data in a target object. |
PostProcessTask | Processes data in a target object. |
get_image_info | Retrieves basic information about an image. |
get_image_infoexif | Retrieves basic and EXIF information about an image. |
get_image_exif | Retrieves the EXIF information of an image. |
OptionObject | Checks whether an object can be accessed by using a cross-origin request. |
Query OSS data events by using SLS
The LookupEvents API only supports querying management events. Data events for OSS operations, such as PutObject, are not covered by LookupEvents and must be queried in Log Service (SLS). After you create a trail, allow 5 to 30 minutes for data events to be delivered to SLS before you query them.
The following example shows how to query PutObject upload events in SLS:
* | SELECT eventTime, sourceIPAddress, userIdentity.userName, requestParameters.objectKey
WHERE eventName = 'PutObject'
ORDER BY eventTime DESCThis query returns the time, source IP address, identity of the operator, and object path of each upload, which you can use to trace anomalous upload activity.