Get key information using different users or interfaces - ActionTrail

ActionTrail records Key Management Service (KMS) events so you can audit who accessed a key, when, from which region, and through which interface. This topic covers example events for four scenarios: an Alibaba Cloud account using the console, a RAM user using the console, a RAM user calling the API with an AccessKey, and a RAM user assuming a role.

Alibaba Cloud account gets key information from the console

In this example, an Alibaba Cloud account called the DescribeKey operation at 17:21:32 on August 5, 2021 (UTC+8) to retrieve information about key 3a6a031d-87ad-4a84-9c17-aa22e0b0**** in the China (Hangzhou) region.

{
  "eventId": "ab35a7a7-373a-4a36-a4f8-01fd6adcc6a0",
  "eventVersion": 1,
  "eventSource": "kms-intranet.cn-hangzhou.aliyuncs.com",
  "requestParameters": {
    "KeyId": "3a6a031d-87ad-4a84-9c17-aa22e0b0****"
  },
  "sourceIpAddress": "Internal",
  "userAgent": "AliyunConsole",
  "eventType": "ApiCall",
  "userIdentity": {
    "accountId": "506899367883****",
    "principalId": "506899367883****",
    "type": "root-account",
    "userName": "root"
  },
  "serviceName": "Kms",
  "apiVersion": "2016-01-20",
  "requestId": "ab35a7a7-373a-4a36-a4f8-01fd6adcc6a0",
  "eventTime": "2021-08-05T09:21:32Z",
  "isGlobal": false,
  "acsRegion": "cn-hangzhou",
  "eventName": "DescribeKey"
}

The key fields are described below.

userIdentity.type: The identity type of the requester. The value root-account indicates an Alibaba Cloud account.
serviceName: The Alibaba Cloud service that received the request. The value Kms indicates KMS.
eventName: The operation that triggered the event. The value DescribeKey indicates a key information retrieval request.
requestParameters.KeyId: The ID of the key that was accessed. The value is 3a6a031d-87ad-4a84-9c17-aa22e0b0****.
acsRegion: The region where the event occurred. The value cn-hangzhou indicates the China (Hangzhou) region.
eventTime: The time the event occurred, in UTC. The value 2021-08-05T09:21:32Z corresponds to 17:21:32 on August 5, 2021 (UTC+8).

RAM user gets key information from the console

In this example, the Resource Access Management (RAM) user Alice called the DescribeKey operation at 16:53:03 on August 5, 2021 (UTC+8) to retrieve information about key e1ea5c30-04d3-41e4-b445-1eb5b656**** in the China (Hangzhou) region.

{
  "eventId": "c8d094ca-64b8-49cf-bbf3-2a9b540abed9",
  "eventVersion": 1,
  "eventSource": "kms-intranet.cn-hangzhou.aliyuncs.com",
  "requestParameters": {
    "KeyId": "e1ea5c30-04d3-41e4-b445-1eb5b656****"
  },
  "sourceIpAddress": "192.168.XX.XX",
  "userAgent": "AliyunConsole",
  "eventType": "ApiCall",
  "userIdentity": {
    "accountId": "111737649404****",
    "principalId": "23899132441193****",
    "type": "ram-user",
    "userName": "Alice"
  },
  "serviceName": "Kms",
  "apiVersion": "2016-01-20",
  "requestId": "c8d094ca-64b8-49cf-bbf3-2a9b540abed9",
  "eventTime": "2021-08-05T08:53:03Z",
  "isGlobal": false,
  "acsRegion": "cn-hangzhou",
  "eventName": "DescribeKey"
}

Compared to the Alibaba Cloud account example, this event shows userIdentity.type as ram-user and includes userIdentity.userName to identify the specific RAM user. The key fields are described below.

userIdentity.type: The identity type of the requester. The value ram-user indicates a RAM user.
userIdentity.userName: The username of the RAM user who made the request.
serviceName: The Alibaba Cloud service that received the request. The value Kms indicates KMS.
eventName: The operation that triggered the event. The value DescribeKey indicates a key information retrieval request.
requestParameters.KeyId: The ID of the key that was accessed. The value is e1ea5c30-04d3-41e4-b445-1eb5b656****.
acsRegion: The region where the event occurred. The value cn-hangzhou indicates the China (Hangzhou) region.
eventTime: The time the event occurred, in UTC. The value 2021-08-05T08:53:03Z corresponds to 16:53:03 on August 5, 2021 (UTC+8).

RAM user gets key information by calling an API with an AccessKey

In this example, the RAM user kms-test called the DescribeKey operation at 17:02:30 on August 5, 2021 (UTC+8). The user authenticated with AccessKey ID LTAI**************** to retrieve information about key e1ea5c30-04d3-41e4-b445-1eb5b656**** in the China (Hangzhou) region.

{
  "eventId": "da43d031-cf5a-44ec-aec8-4a13f468aa12",
  "eventVersion": 1,
  "eventSource": "kms.cn-hangzhou.aliyuncs.com",
  "requestParameters": {
    "KeyId": "e1ea5c30-04d3-41e4-b445-1eb5b656****"
  },
  "sourceIpAddress": "192.168.XX.XX",
  "userAgent": "AlibabaCloud (Linux; amd64) Java/1.8.0_212-b04 Core/4.5.1 HTTPClient/ApacheHttpClient",
  "eventType": "ApiCall",
  "userIdentity": {
    "accessKeyId": "LTAI****************",
    "accountId": "164165083897****",
    "principalId": "21682348916186****",
    "type": "ram-user",
    "userName": "kms-test"
  },
  "serviceName": "Kms",
  "apiVersion": "2016-01-20",
  "requestId": "da43d031-cf5a-44ec-aec8-4a13f468aa12",
  "eventTime": "2021-08-05T09:02:30Z",
  "isGlobal": false,
  "acsRegion": "cn-hangzhou",
  "eventName": "DescribeKey"
}

Unlike the console-based examples, this event includes userIdentity.accessKeyId, which records the AccessKey used for the API call. The key fields are described below.

userIdentity.accessKeyId: The AccessKey ID used to authenticate the API call. The value is LTAI.
userIdentity.principalId: The ID of the RAM user who owns the AccessKey. The value is 21682348916186****.
userIdentity.type: The identity type of the requester. The value ram-user indicates a RAM user.
userIdentity.userName: The username of the RAM user who made the request.
serviceName: The Alibaba Cloud service that received the request. The value Kms indicates KMS.
eventName: The operation that triggered the event. The value DescribeKey indicates a key information retrieval request.
requestParameters.KeyId: The ID of the key that was accessed. The value is e1ea5c30-04d3-41e4-b445-1eb5b656****.
acsRegion: The region where the event occurred. The value cn-hangzhou indicates the China (Hangzhou) region.
eventTime: The time the event occurred, in UTC. The value 2021-08-05T09:02:30Z corresponds to 17:02:30 on August 5, 2021 (UTC+8).

RAM user gets key information by assuming a role

In this example, at 17:20:28 on August 5, 2021 (UTC+8), a RAM user of Alibaba Cloud account 132295042695**** assumed the RAM role aliyunedasdefaultrole of Alibaba Cloud account 119997133354**** to retrieve information about key e1ea5c30-04d3-41e4-b445-1eb5b656**** in the China (Hangzhou) region.

{
  "eventId": "4e059394-8b95-4788-84cf-efe7aa8f6935",
  "eventVersion": 1,
  "eventSource": "kms.cn-hangzhou.aliyuncs.com",
  "requestParameters": {
    "KeyId": "e1ea5c30-04d3-41e4-b445-1eb5b656****",
    "stsTokenPlayerUid": "132295042695****"
  },
  "sourceIpAddress": "192.168.XX.XX",
  "userAgent": "AlibabaCloud (Linux; amd64) Java/1.8.0_92-b18 Core/4.5.6 HTTPClient/ApacheHttpClient",
  "eventType": "ApiCall",
  "userIdentity": {
    "accessKeyId": "STS.****************",
    "accountId": "119997133354****",
    "principalId": "34933955188809****:fb23c186-5930-498a-a630-0a****",
    "type": "assumed-role",
    "userName": "aliyunedasdefaultrole:fb23c186-5930-498a-a630-0a****"
  },
  "serviceName": "Kms",
  "apiVersion": "2016-01-20",
  "requestId": "4e059394-8b95-4788-84cf-efe7aa8f6935",
  "eventTime": "2021-08-05T09:20:28Z",
  "isGlobal": false,
  "acsRegion": "cn-hangzhou",
  "eventName": "DescribeKey"
}

When a RAM role is assumed, STS temporary credentials appear in userIdentity. Use userIdentity.userName to identify both the role and the session, and requestParameters.stsTokenPlayerUid to find the account that assumed the role. The key fields are described below.

userIdentity.type: The identity type of the requester. The value assumed-role indicates the request was made using a RAM role.
userIdentity.userName: The requester identity in {roleName}:{sessionName} format, where roleName is the assumed role and sessionName is the session name specified at role assumption time. The value aliyunedasdefaultrole:fb23c186-5930-498a-a630-0a**** means the assumed role is aliyunedasdefaultrole and the session name is fb23c186-5930-498a-a630-0a****.

Note
By default, Enterprise Distributed Application Service (EDAS) uses the aliyunedasdefaultrole role to access your resources in other cloud services.
requestParameters.stsTokenPlayerUid: The Alibaba Cloud account ID of the entity that assumed the role. The value is 132295042695****.
serviceName: The Alibaba Cloud service that received the request. The value Kms indicates KMS.
eventName: The operation that triggered the event. The value DescribeKey indicates a key information retrieval request.
requestParameters.KeyId: The ID of the key that was accessed. The value is e1ea5c30-04d3-41e4-b445-1eb5b656****.
acsRegion: The region where the event occurred. The value cn-hangzhou indicates the China (Hangzhou) region.
eventTime: The time the event occurred, in UTC. The value 2021-08-05T09:20:28Z corresponds to 17:20:28 on August 5, 2021 (UTC+8).