All Products
Search

This Product

    ActionTrail:Security for auditing

    Document Center

    ActionTrail:Security for auditing

    Last Updated:Jun 09, 2026

    ActionTrail records and lets you query events about your activity on Alibaba Cloud. These events are critical for security analysis, troubleshooting, and upholding your IT governance model on the cloud. Protecting this sensitive data from tampering and unauthorized access is essential for audit integrity. This topic describes recommended security practices.

    Auditing and security analysis with trails

    Desired outcome

    Solution

    Description

    References

    Meet compliance requirements for long-term event retention, such as storing events for longer than the default 90 days.

    Create a trail.

    ActionTrail stores events for the last 90 days. Without a trail, ActionTrail deletes the oldest day's records daily. To store events for more than 90 days, you must create a trail.

    You can create a trail to continuously deliver events to Object Storage Service (OSS) for long-term storage.

    While a trail can also deliver events to Log Service (SLS) for monitoring and analysis, OSS is the recommended and more cost-effective solution for long-term archiving.

    Capture a complete record of all events to meet national and industry compliance standards.

    Configure the trail to capture All Events from all regions.

    To ensure a complete record of all activity in your Alibaba Cloud account, set your trail's scope to all regions. This ensures that events from all current and future regions are captured automatically.

    Because compliance often requires auditing both read and write operations, set the event type to All Events.

    • Store events for long-term retention (more than 90 days) as required by IT or compliance departments.

    • Archive or download events to provide historical data to compliance auditors.

    • Analyze and create alerts for sensitive operations.

    Deliver events to Object Storage Service (OSS) or Log Service (SLS).

    You can create a trail to deliver events to either OSS or SLS.

    • Object Storage Service (OSS): Provides cost-effective, long-term storage. You can download events as needed for analysis or reporting.

    • Log Service (SLS): Enables real-time analysis of operations, allows you to create monitoring dashboards, and can send alert notifications for specific events through email, or DingTalk.

    Secure management of events

    Desired outcome

    Solution

    Description

    References

    Encrypt events delivered to OSS to ensure data security at rest.

    Use Key Management Service (KMS) for encryption.

    When you create a trail to deliver events to OSS, server-side encryption using OSS-managed keys (SSE-OSS) is enabled by default.

    If you need to manage the keys yourself, use server-side encryption with keys hosted in Key Management Service (KMS), also known as SSE-KMS. You can:

    • Create a bucket on the OSS console with server-side encryption enabled, then create a trail on the ActionTrail console that delivers events to that bucket.

    • Create a new bucket and enable server-side encryption directly on the ActionTrail console when you create the trail.

    Server-side encryption

    Encrypt events delivered to SLS to ensure data security at rest.

    Use KMS-managed keys or SLS service keys for encryption.

    When you create a trail that delivers events to SLS, ActionTrail automatically creates a Logstore named actiontrail_<trail_name>. You can then encrypt this Logstore by using a KMS-managed key or an SLS service key to protect the event data.

    Data encryption

    Prevent modification or deletion of events stored in OSS or SLS to ensure data integrity and reliability.

    Configure an OSS retention policy.

    When you create a trail that delivers events to OSS, configure a retention policy on the bucket. For example, you can add a time-based retention policy to prevent anyone from modifying or deleting events during the protection period.

    Note

    Log data in Log Service (SLS) cannot be modified or deleted on a per-entry basis. Once written, a log entry is immutable.

    The only way to delete audit logs in SLS is to change the data retention period of the Logstore. We recommend restricting permissions for SLS to read-only access, such as by granting the AliyunLogReadOnlyAccess policy, to prevent users from deleting logs by shortening the retention period.

    Bucket-level retention policy (BucketWorm)

    Strictly control access to event data.

    Apply the principle of least privilege for OSS and SLS access.

    To successfully deliver events, the Alibaba Cloud account or RAM user creating the trail needs permissions to access OSS or SLS. Similarly, users who review events must have read permissions.

    Configure permissions according to the principle of least privilege. This practice helps prevent accidental deletion or modification of service instances and restricts unnecessary access to sensitive event data.

    Strictly control administrative permissions for ActionTrail.

    Limit who has ActionTrail administrator permissions.

    A user with the AliyunActionTrailFullAccess policy (the ActionTrail administrator permission) can modify and delete trails. Changes to a trail can disrupt event delivery, compromising your tracking and auditing capabilities.

    Grant this permission to as few users as possible.