ActionTrail:Monitor KMS key usage in ActionTrail

Prerequisites

• Make sure that Simple Log Service (SLS) is activated. For more information, see Activate Simple Log Service.

  Note

  Activating Simple Log Service is free of charge. You are charged when ActionTrail delivers audit events to Simple Log Service and you use its query and analysis features. For more information, see Billing overview.

• Make sure that you have created a trail that meets the following requirements:

  • The trail is created for all regions.

  • The event type is set to management event.

  • The read/write type is set to All.

  • Events are delivered to Simple Log Service (SLS).

  Note

  If no trail exists in the current account or the existing trails do not meet the requirements, create an eligible trail first. For more information, see Create a single-account trail or Create a multi-account trail.

Scenario 1: Query key management events

1. Log on to the ActionTrail console.

2. In the left-side navigation pane, choose Events > Advanced Event Query.

3. In the left-side Query Range pane, select the target trail.

4. On the Default tab, set the following query conditions.

   • Set Service Name to Key Management Service (KMS).

   • Set Event Name to CreateKey, ScheduleKeyDeletion, EnableKey, and DisableKey.

5. Set a time range and click Run.

6. View the query results.

   • Raw log

     On the Raw Logs tab, view all records of KMS key creation, deletion, enabling, and disabling within the specified time range. To view the details and raw log of a specific event, find the event and click View Event Details in the Actions column.

   • Query histogram

     On the Query Histogram tab, view the histogram of the events.

7. (Optional) To query specific information, such as the operator, event, or key ID, you can use an SQL statement to filter the results.

   1. In the upper-right corner, turn off the Simple Mode switch and enter the following query statement.

      event.serviceName:Kms AND (event.eventName:CreateKey OR event.eventName:ScheduleKeyDeletion OR event.eventName:EnableKey OR event.eventName:DisableKey)
      | SELECT date_format(__time__, '%Y-%m-%d %H:%i:%s') as time,"event.eventName" as eventName,"event.userIdentity.userName" as user,"event.resourceName" as keyId

   2. Set a time range and click Run.

   3. View the query results.

      • Aggregation analysis

        On the Aggregation Analysis tab, view the filtered information: operation time, operation event, operator, and key ID.

      • Raw log

        On the Raw Logs tab, find the target event and click View Event Details in the Actions column to view the basic information and raw log of the event.

      • Query histogram

        On the Query Histogram tab, view the histogram of the events.

Scenario 2: Query usage of a specific KMS key

1. Log on to the ActionTrail console.

2. In the left-side navigation pane, choose Events > Advanced Event Query.

3. In the left-side Query Range pane, select the target trail.

4. In the upper-right corner, turn off the Simple Mode switch and enter the ID of the KMS key that you want to query.

5. Set a time range and click Run.

6. View the query results.

   • Raw log

     On the Raw Logs tab, view the operation events related to the specified key ID within the selected time range. To view the details and raw log of a specific event, find the event and click View Event Details in the Actions column.

   • Query histogram

     On the Query Histogram tab, view the histogram of the events.

7. (Optional) To gather usage statistics for a specific key, such as its related event names and source IP addresses, you can use an SQL statement to aggregate the data.

   1. Enter the following query statement.

      "<YourKmsKeyId>" | SELECT DISTINCT "event.eventName" as eventName,"event.sourceIpAddress" as ip,count(*) as num GROUP BY eventName,ip ORDER BY count(*) DESC

      Note

      Replace <YourKmsKeyId> with the ID of your KMS key.

   2. Set a time range and click Run.

   3. View the query results.

      • Aggregation analysis

        On the Aggregation Analysis tab, view the aggregated call statistics: related events, source IP addresses, and number of calls.

      • Raw log

        On the Raw Logs tab, find the target event and click View Event Details in the Actions column to view the basic information and raw log of the event.

      • Query histogram

        On the Query Histogram tab, view the histogram of the events.

Related documents

• You can also use the event query feature in the ActionTrail console to query KMS-related events from the last 90 days. For more information, see Query events in the ActionTrail console.

• For more information about how to query KMS operation events, see Query usage records for keys and secrets.