ActionTrail monitors and records activities in your Alibaba Cloud account, including operations performed through the Alibaba Cloud Management Console, OpenAPI, and developer tools. You can store these activity records, called events, in Simple Log Service (SLS) or Object Storage Service (OSS) for behavioral analysis, security analysis, resource change tracking, and compliance auditing.
The following figure shows how ActionTrail works.
Event types
ActionTrail records two types of events: management events and data events.
By default, ActionTrail retains management events for each account for 90 days. You can query and download these events online. Data events are not collected or stored by default. To record data events, create a trail and enable data event recording.
|
Type |
Description |
Storage method |
|
Management event |
Records management operations (also known as control plane operations), such as creating, modifying, or deleting resources in your Alibaba Cloud account. Examples include creating an ECS instance or deleting a security group rule. Management events also include console-related events, such as signing in to the Alibaba Cloud Management Console ( |
By default, ActionTrail retains management events for each account for 90 days. You can query and download these events online. |
|
Data event |
Records read and write operations (also known as data plane operations) on data within your cloud resources. Examples include reading an object from an OSS bucket or querying data in Tablestore. |
ActionTrail does not collect or store data events by default. To record data events, create a data event trail and deliver the events to Simple Log Service (SLS) or Object Storage Service (OSS) for storage and analysis. You are charged for storing events in SLS or OSS based on the billing standards of each service. |
Features
-
Out-of-the-box: ActionTrail tracks and records management events for 90 days by default, requiring no configuration. You can view these events online.
NoteIf you need to retain operation logs for a longer period or record data events, create a trail. For more information, see Create a single-account trail or Create a multi-account trail.
-
Self-service management: Create a trail to store events in Simple Log Service (SLS) as logs or in Object Storage Service (OSS) as files. After events are delivered, you are charged based on the billing standards of the destination service. You can use the search and analysis features of SLS or transfer data to big data products for authorization, lifecycle management, archiving, search, analysis, and alerting.
-
Multi-dimensional query: Query events by dimensions such as event time, username, resource type, resource name, or event name.
Use cases
-
Regulatory compliance: To meet requirements such as MLPS 2.0, which mandates that cloud tenants record account activity and retain records for at least 180 days, you can use ActionTrail to deliver activity records to Simple Log Service or an OSS bucket for long-term retention.
-
Security analysis: ActionTrail records user operations in detail. You can use these events to identify potential security risks in your account.
For example, configure a trail to deliver operation events to a Logstore in Simple Log Service (SLS) for long-term storage and SQL-based analysis.
-
Resource change tracking: When an unexpected change occurs on your resources, ActionTrail events can help you identify the cause. For example, if an ECS instance is stopped unexpectedly, you can use ActionTrail to determine who stopped it, when the operation occurred, and the source IP address.
-
Compliance auditing: If your organization manages multiple members with Resource Access Management (RAM), ActionTrail helps you meet compliance auditing requirements by providing detailed events for each member. You can create multiple trails to deliver specific event types from different regions to separate storage locations, aligning with the responsibilities of different auditors.
For example, if you have deployed resources on both the Alibaba Cloud China site and the international site, create multiple trails to track operational events in different countries and regions and deliver them to local storage to comply with data security requirements.
Benefits
-
Timely delivery: ActionTrail captures events from console operations, API calls, and service roles, typically delivering them within 10 minutes.
-
Detailed records: ActionTrail records detailed contextual information for each operation. You can view events from the last 90 days on the ActionTrail console or by calling an API. For example, you can identify who performed an action, on which resource, at what time, and from which source IP address. You can also determine whether the action was initiated from the API or the console, whether it succeeded, and the reason for any failures.
-
High reliability: ActionTrail delivers events to highly available storage services such as Simple Log Service (SLS) and Object Storage Service (OSS). These services protect your audit data through encryption and access controls. ActionTrail also notifies you when events are delivered.
-
Custom trails: Create up to five trails in each region to track different event types and geographic scopes. Deliver events to separate storage destinations to segregate audit data based on employee responsibilities.
NoteAvoid delivering the same event type from the same region to the same destination more than once.
-
Platform transparency: ActionTrail records and stores Alibaba Cloud platform operation logs in near real-time. Delivering these logs to Simple Log Service gives you query, analysis, alerting, and reporting capabilities, providing full visibility into platform operations for analysis and auditing.