Deliver events from multiple Alibaba Cloud accounts to a single account - ActionTrail

If you manage multiple Alibaba Cloud accounts, you can use ActionTrail trails to deliver events from these accounts to a central account. This allows you to store events in a Simple Log Service project, an Object Storage Service (OSS) bucket, or a MaxCompute project for centralized data archiving and monitoring.

Background information

The cross-account event delivery feature of ActionTrail involves source accounts and a destination account.

Account	Description	Actions
Destination account	The account that receives events from other accounts.	Create storage resources to receive events, such as a Simple Log Service project, an Object Storage Service (OSS) bucket, or a MaxCompute table. Create a RAM role that can be assumed by the ActionTrail service. Source accounts assume this role to write events to the destination account.
Source account	An account that needs to deliver events to the destination account.	Create a trail to deliver events to the storage resources in the destination account.

When the destination account and source accounts are independent Alibaba Cloud accounts that do not have an organizational relationship, you must create a separate single-account trail for each source account. The following procedure uses an example where Alibaba Cloud account A and Alibaba Cloud account B (source accounts) deliver events to Alibaba Cloud account C (destination account).

Procedure

In Alibaba Cloud account C, create a RAM role and grant permissions to ActionTrail to deliver events to this account.
1. Log on to the RAM console by using Alibaba Cloud account C.
2. Attach the AliyunActionTrailDeliveryPolicy system policy to the ActionTrailDeliveryRole role.
  1. Click the name of the ActionTrailDeliveryRole role.
  2. Click Input and Attach.
  3. Select System Policy and set Policy Name to AliyunActionTrailDeliveryPolicy.
  4. Click Confirm and then click Close.
  Note
  Supported policies are listed in System permission policies for event delivery.
3. Modify the trust policy of the RAM role. Change the Service field to the Alibaba Cloud account ID@actiontrail.aliyuncs.com format.
  For example, if the ID of Alibaba Cloud account A is 159498693825**** and the ID of Alibaba Cloud account B is 123435555956****, you must change actiontrail.aliyuncs.com in the Service field to ["159498693825****@actiontrail.aliyuncs.com","123435555956****@actiontrail.aliyuncs.com"]. This allows the ActionTrail service in Alibaba Cloud account A (159498693825****) and Alibaba Cloud account B (123435555956****) to assume the RAM role.
```
{
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "159498693825****@actiontrail.aliyuncs.com",
                    "123435555956****@actiontrail.aliyuncs.com"
                ]
            }
        }
    ],
    "Version": "1"
}
```
  For more information, see Modify the trust policy of a RAM role.
In Alibaba Cloud account C, create a Simple Log Service project, an OSS bucket, or a MaxCompute project.
For more information, see Create a project, Create a bucket, and Create a project.
Note
The name of the MaxCompute project must start with actiontrail_.
For data security, we recommend that you enable server-side encryption and configure a retention policy when you create the OSS bucket. For more information, see Server-side encryption and Configure a retention policy.

In Alibaba Cloud account A, create a single-account trail and set the delivery destination to the Simple Log Service project, OSS bucket, or MaxCompute project that you created in Step 2.

Log on to the ActionTrail console by using Alibaba Cloud account A.
In the left-side navigation pane, click Trails.
In the top navigation bar, select the region where you want to create the single-account trail.
Note
This region becomes the home region for the single-account trail.
On the Trails page, click Create Trail.

On the Create Trail page, configure the trail parameters.

In the Basic Information section, set the trail name and the management event type.
Note
By default, the trail applies to all regions. We recommend that you set Management Event to All Events to capture all events from all regions. For more information about the parameters, see Create a single-account trail.

In the Event Delivery section, choose to deliver events to Simple Log Service, OSS, or MaxCompute. You can deliver events to one or more services. For information about how to choose a storage service, see Deliver events to specified Alibaba Cloud services.

Select Delivery to Log Service, select Delivery to Another Account, and then configure the following parameters.

Parameter

Description

Log Service Project ARN

Enter the region of the project, the ID of Alibaba Cloud account C (the destination account), and the project name.

The project name is the name of the project that you created in Step 2.

RAM Role ARN of Destination Account

Enter the ID of Alibaba Cloud account C (the destination account) and the role name.

The role name is the name of the RAM role that you created in Step 1. In this example, the role name is ActionTrailDeliveryRole.

Select Delivery to OSS, select Delivery to Another Account, and then configure the following parameters.

Parameter	Description
RAM Role ARN of OSS Bucket	Enter the ID of Alibaba Cloud account C (the destination account) and the role name. The role name is the name of the RAM role that you created in Step 1. In this example, the role name is ActionTrailDeliveryRole.
Bucket Name	Enter the name of the bucket that you created in Step 2.
Log File Prefix	Enter a prefix for the event log files.

Select Delivery to MaxCompute, select Delivery to Another Account, and then configure the following parameters.

Parameter

Description

RAM Role ARN of MaxCompute

Enter the ID of the destination account and the role name.

The role name is the name of the RAM role that you created in Step 1. In this example, the role name is ActionTrailDeliveryRole.

Project ARN

Enter the region of the MaxCompute project, the ID of the destination account, and the name of the MaxCompute project. The project name is the name of the project that you created in Step 2.

Click Confirm.

Repeat these steps for Alibaba Cloud account B to create another single-account trail that delivers events to the destination created in Step 2.

Results

After the trails are created, you can use Alibaba Cloud account C to view events from accounts A and B in the Simple Log Service project, OSS bucket, or MaxCompute project. For more information, see Query and analyze logs and Real-time log query.

Related operations

If you need to migrate data between different accounts, see the following topics:
- Online data migration for OSS
- Online data migration for Simple Log Service
If you need to further analyze the delivered events, see the following topic:
Analyze operation events in Simple Log Service