An AccessKey includes an AccessKey ID and an AccessKey secret. They are used to identify and authenticate a user. A leaked AccessKey threatens the security of your resources. ActionTrail helps you monitor AccessKey-related events so you can respond quickly to abnormal usage.
Prerequisites
Simple Log Service is activated. Activate Simple Log Service.
Activating Simple Log Service (SLS) is free of charge. However, you are charged when ActionTrail delivers audit events to SLS and you use its query and analysis features. For more information about billing, see Billing overview.
Background information
You can use ActionTrail to query AccessKey-related events. You can also deliver events to Simple Log Service and set alerts to monitor AccessKey usage.
-
Query AccessKey-related events from the last 90 days: On the Event Query page in the ActionTrail console, set the filter condition to AccessKey ID. For more information, see Query events in the ActionTrail console.
-
Query AccessKey-related events older than 90 days: Follow the steps in this topic to query events older than 90 days and set alerts.
Step 1: Create a trail
This section uses a single-account trail as an example to show how to create a trail and deliver events to Simple Log Service (SLS).
-
Log on to the ActionTrail console.
-
In the left-side navigation pane, click trails.
-
In the top navigation bar, select the region where you want to create a single-account trail.
NoteThis region becomes the home region for the single-account trail.
-
On the trails page, click Create Trail.
-
On the Create Trail page, set the trail parameters.
-
In the Basic Information section, configure the following parameters:
Parameter
Description
Trail Name
The name of the trail. The name must be unique within your Alibaba Cloud account.
Trail Event Type
By default, Management Event is selected.
-
In the Management Event Delivery Settings section, configure the following parameters.
-
Set Read/Write Type to All Events.
-
Select Delivery to Log Service.
-
Set Destination Account to Delivery to Current Account.
-
Set Project to New Log Service Project. Then, select a Logstore Region and enter a Project Name.
-
-
-
Click Confirm.
Step 2: Query events and set alerts in Simple Log Service
-
In the ActionTrail console, click trails.
-
Find your trail. In the Storage Service column, hover over SLS or SLS&OSS and click the Logstore name.
-
In the upper-right corner of the page, click Last 15 Minutes to set a time range for your query.
-
In the search box, enter the query statement:
event.userIdentity.accessKeyId: "<YourAccessKeyId>" | select count(1) as use_ak_<YourAccessKeyId>, and click Search & Analyze.NoteReplace
<YourAccessKeyId>with your AccessKey ID. -
Save the query as a Save as Saved Search or an Save as Alert.
-
Save as Saved Search: In the upper-right corner of the query and analysis page, click the
icon, enter a Saved Query Name, and then click Confirm. NoteAfter you save the query as a saved search, you can select it directly in the Simple Log Service console.
For more information, see Saved search.
-
Save as Alert: In the upper-right corner of the query and analysis page, click the
icon. In the Alert Monitoring Rule panel, configure the parameters and click Confirm. For more information, see Set an alert.
NoteAfter you save the query as an alert, you will receive a notification when the alert is triggered. For example, after you set the alert as described, an alert is triggered if the
accessKeyIdis used within a 5-minute period.
-
Results
You can manage the created saved searches and alerts in the Simple Log Service console.
In the left-side navigation pane, expand Resources and click Saved search to manage your saved searches, or click the Alerts icon to manage your alerts.