All Products
Search

This Product

    ActionTrail:Query cloud services and call records for an access key pair

    Document Center

    ActionTrail:Query cloud services and call records for an access key pair

    Last Updated:Aug 20, 2026

    ActionTrail provides several ways to find event details for an access key pair. Use the AccessKey Pair Audit feature to identify which cloud services were accessed and from which IP addresses, or use Event Query to look up detailed event records.

    Query cloud services accessed by an access key pair

    Note

    • AccessKey Pair Audit covers all cloud services accessed by a specific access key pair since the feature was launched.

    • Data latency can be up to several hours, so use caution when making changes to an access key pair based on this information.

    1. Log on to the ActionTrail console.

    2. In the left-side navigation pane, click AccessKey Pair Audit.

    3. On the AccessKey Pair Audit page, enter an AccessKey ID and click the 查询按钮 icon. You can then view details about the access key pair, including the associated RAM user, the cloud services it has accessed, and the last used time.

      The query results also show the account ID and RAM user ID. In the Accessed Cloud Services table, each entry links to the Event List, IP Address List, and Resource List for further investigation.

    4. As needed, review the Event List, IP Address List, and Resource List.

      • Query the event list

        1. In the Actions column for a cloud service, click Event List to view the events initiated by the access key pair and the last call time for each event.

        2. In the Actions column for an event, click View Details to view the details of the last recorded event.

      • Query the IP address list

        1. In the Actions column for a cloud service, click IP Address List to view the source IP addresses of the requests and the time each was last used.

        2. In the Actions column for an IP address, click View Details to view the details of the last recorded event.

      • Query the resource list

        1. In the Actions column for a cloud service, click Resource List to view the specific resources accessed by the access key pair and their last access time.

        2. In the Actions column for a resource type, click View Details to view the details of the last recorded event.

    Query detailed call records for an access key pair

    Note

    Specific events for an access key pair can be queried only for the cloud services and events that ActionTrail supports. For more information, see Cloud services and events supported by ActionTrail.

    1. Log on to the ActionTrail console.

    2. In the left-side navigation pane, click Event Detail Query.

    3. In the top navigation bar, select the region where you want to query events.

    4. On the Event Detail Query page, set the filter condition to AccessKey ID and enter the AccessKey ID.

    5. Set the time range for the query and click the 查询按钮 icon.

    6. (Optional) If Advanced Event Query is enabled for your account, you can select Events > Advanced Query in the ActionTrail console to query the call records for the access key pair across all regions.

      Note

      • Advanced Event Query supports only certain detailed events.

      • You can use simple query mode, set the filter condition to AccessKey ID, enter the ID, select a time range, and then click Run.

      • You can also turn off simple query mode, enter the condition statement event.userIdentity.accessKeyId:*, select a time range, and then click Run.

    Notes

    ActionTrail can identify all cloud services accessed by an access key pair. However, specific events can be queried only for supported cloud services and event types. For more information, see Cloud services and events supported by ActionTrail.

    If a query shows that an access key pair accessed a cloud service but the Event List, IP Address List, or Resource List is empty or shows a mismatched last access time, ActionTrail does not yet support that cloud service or event type.

    References