Deliver events from a resource directory to a single account - ActionTrail

Use ActionTrail trails to deliver events from multiple resource directory members to a single SLS Logstore, OSS bucket, or MaxCompute project for centralized audit data archiving and monitoring.

Background information

Cross-account event delivery in ActionTrail uses two account types: destination and source.

Account	Description	Actions
Destination account	The account that receives events from other accounts.	Create a storage destination: an SLS Logstore, OSS bucket, or MaxCompute table. Create a RAM role that trusts ActionTrail. Source accounts assume this role to write events.
Source account	An account that writes events to the destination account.	Create a trail from the management account to deliver events to the destination account's storage.

When both accounts are in the same resource directory, the directory's trust relationship simplifies cross-account delivery. Two scenarios apply based on the destination account type:

If the destination account is the management account, create a multi-account trail to deliver events from all directory members to Simple Log Service (SLS), Object Storage Service (OSS), or MaxCompute in the management account.
If the destination account is a member, follow the steps in this topic.

Procedure

In the destination account, create a RAM role to allow ActionTrail to deliver events.
1. Log on to the RAM console with the destination account.
  1. In the left-side navigation pane, choose Identities > Roles.
  2. On the Roles page, click Create Role.
  3. Set Principal Type to Cloud Service, set Principal Name to ActionTrail, and click Confirm.
  4. Set Role Name to ActionTrailDeliveryRole and click Confirm.
2. Attach the AliyunActionTrailDeliveryPolicy system policy to the ActionTrailDeliveryRole role.
  1. Click the name of the ActionTrailDeliveryRole role.
  2. Click Input and Attach.
  3. Select System Policy and set Policy Name to AliyunActionTrailDeliveryPolicy.
  4. Click Confirm and then click Close.
  Note
  Supported policies are listed in System permission policies for event delivery.
3. Modify the trust policy of the RAM role by changing the Service field to the management account@actiontrail.aliyuncs.com format.
  For example, if the management account ID is 159498693826****, change actiontrail.aliyuncs.com in the Service element to 159498693826****@actiontrail.aliyuncs.com. This allows the RAM role to be assumed by the ActionTrail service of management account 159498693826****.
```
{
    "Statement": [
        {
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "Service": [
                    "159498693826****@actiontrail.aliyuncs.com"
                ]
            }
        }
    ],
    "Version": "1"
}
```
Use the destination account to create an SLS project, an OSS bucket, or a MaxCompute project.

Follow the instructions in Create an SLS project, Create an OSS bucket, or Create a MaxCompute project.

Note
The name of the MaxCompute project must start with actiontrail_.

For data security, enable server-side encryption and configure a retention policy when you create the OSS bucket.

Use the management account to create a multi-account trail and set the delivery destination to the SLS project, OSS bucket, or MaxCompute project that you created in Step 2.

Log on to the ActionTrail console with the management account.
In the left-side navigation pane, click Trails.
In the top navigation bar, select the home region for the multi-account trail.

Note
The selected region becomes the trail's home region.
On the Trails page, click Create Trail.

On the Create Trail page, configure the trail parameters.

In the Basic Information section, configure basic event delivery settings.
Note
- Set Apply Trail to All Members to Yes.
- By default, the trail delivers events from all regions. Set Management Event to All Events to track all events in all regions.
- For parameter details, see Create a multi-account trail.

In the Event Delivery section, configure event delivery to SLS, OSS, or MaxCompute. You can deliver to multiple services simultaneously. To choose a storage service, see Continuously deliver events to a specified service.

Select Delivery to Log Service and Delivery to Another Account, then configure the following parameters.

Parameter

Description

Log Service Project ARN

Enter the SLS project region, the destination account's Alibaba Cloud account ID, and the SLS project name.

Use the project created in Step 2.

RAM Role ARN of Destination Account

Enter the destination account's Alibaba Cloud account ID and role name.

Use the RAM role created in Step 1. In this example, the role is ActionTrailDeliveryRole.

Select Delivery to OSS and Delivery to Another Account, then configure the following parameters.

Parameter	Description
RAM Role ARN of OSS Bucket	Enter the destination account's Alibaba Cloud account ID and role name. Use the RAM role created in Step 1. In this example, the role is ActionTrailDeliveryRole.
Bucket name	Enter the OSS bucket name from Step 2.
Log File Prefix	Enter a prefix for the event log files.

Select Delivery to MaxCompute and Delivery to Another Account, then configure the following parameters.

Parameter

Description

RAM Role ARN of MaxCompute

Enter the destination account's Alibaba Cloud account ID and role name.

Use the RAM role created in Step 1. In this example, the role is ActionTrailDeliveryRole.

Project ARN

Enter the MaxCompute project region, the destination account's Alibaba Cloud account ID, and the MaxCompute project name. Use the project created in Step 2.

Click Confirm.

Result

After the trail is created, use the destination account to view member events in the SLS project, OSS bucket, or MaxCompute project. To query events, see Quick start for query and analysis and Query real-time logs.