This topic describes the key fields of a management event, lists the common subfields of requestParameters, eventAttributes, and userIdentity, and provides an example.
Key fields
The following table describes the key fields of a management event, listed in alphabetical order by field name.
| Parameter | Description |
acsRegion | The Alibaba Cloud region. |
additionalEventData | Additional information about the event. |
apiVersion | If eventType is set to ApiCall, the event indicates an API call. In this case, this field indicates the version of the API. |
errorCode | The error code that is recorded if an error occurs when the cloud service processes the API request. |
errorMessage | The error message that is recorded if an error occurs when the cloud service processes the API request. |
eventAttributes | The attributes of the event. For more information, see Fields in eventAttributes. |
eventCategory | The category of the event. Valid value: Management, which indicates a management event. |
eventId | The ID of the event. |
eventName | The name of the event. The meaning of this field depends on the event type: - If eventType is set to ApiCall, this field indicates the name of the API operation. - If eventType is not set to ApiCall, this field indicates the meaning of the event. |
eventRW | The read/write type of the event. Valid values: - Write: a write operation. - Read: a read operation. |
eventSource | The source of the event. |
eventTime | The time when the event occurred. The time is displayed in UTC. |
eventType | The type of the event that occurred. Valid values: - ApiCall: an API call event. - ConsoleOperation: a management event from a console page or a purchase page. - ConsoleSignin: a console logon event. - ConsoleSignout: a console logoff event. - AliyunServiceEvent: a management event that the Alibaba Cloud platform performs on your resources. For MaxCompute, a cloud-native big data computing service, eventType can also be one of the following values: JobEvent, TunnelEvent, TableEvent, AdminEvent, ResourceEvent, FunctionEvent, PrivilegeEvent, RoleEvent, UserEvent, or SchemaEvent. For more information about these event types, see Common subfields in requestParameters. |
resourceName | The name of the resource that is associated with the event. The name is the unique identifier of the resource. Note Resource names or IDs of the same type are separated by commas (,). Resource names or IDs of different types are separated by semicolons (;). |
resourceType | The type of the resource that is associated with the event. Note Multiple resource types are separated by semicolons (;). |
responseElements | The data that the API returns. |
serviceName | The Alibaba Cloud service name that is associated with the event. |
sourceIpAddress | The source IP address from which the event was initiated. Valid values: - In most cases, this field indicates the address of the client that sends the request. Both IPv4 and IPv6 addresses are supported. - If an Alibaba Cloud service sends the request, this field indicates the service identifier. Example: ecs.aliyuncs.com. - If the source IP address belongs to a VPC CIDR block or an Alibaba Cloud internal CIDR block and cannot be identified as an address of your VPC, this field is recorded as Internal. |
userAgent | The agent identifier of the client that sends the API request. |
userIdentity | The identity information of the requester. For more information, see Fields in userIdentity. |
vpcId | If the source IP address belongs to a VPC CIDR block and can be identified, this field records the ID of the source VPC. |
Common subfields in requestParameters
The following table describes the common subfields of requestParameters.
| Parameter | Description |
ClientPort | The ephemeral port that the client uses to send the API request. Ephemeral ports are temporary ports on the client, not the ports defined in security group rules. The value is an integer. |
AcsProduct | The identifier of the product that is involved in the request. |
Fields in eventAttributes
The following table describes the fields in eventAttributes.
| Parameter | Description |
SensitiveAction | Indicates that the event is a sensitive operation. Valid value: true. |
Fields in userIdentity
The following table describes the fields in userIdentity.
| Parameter | Description |
type | The type of the identity. The following identity types are supported: - root-account: an Alibaba Cloud account. - ram-user: a Resource Access Management (RAM) user. - assumed-role: a RAM role. - system: an Alibaba Cloud service. - cloudsso-user: a cloud single sign-on (CloudSSO) user. - saml-user: a corporate identity that is based on SAML. - alibaba-cloud-account: the identity that is authorized in cross-account authorization between Alibaba Cloud accounts. - oidc-user: a corporate identity that is based on OIDC. |
principalId | The ID of the current requester. Use this field together with type to uniquely identify the requester. - If type is set to root-account, this field records the Alibaba Cloud account ID. - If type is set to ram-user, this field records the ID of the RAM user. - If type is set to assumed-role, this field records RoleID:RoleSessionName. - If type is set to cloudsso-user, this field records the ID of the CloudSSO user. - If type is set to alibaba-cloud-account: - If an Alibaba Cloud account performs cross-account operations, this field records the Alibaba Cloud account ID. - If a RAM user performs cross-account operations, this field records the ID of the RAM user. - If a RAM role is assumed for cross-account operations, this field records RoleID:RoleSessionName. - If type is set to saml-user, oidc-user, or system, principalId is not recorded. |
accountId | The Alibaba Cloud account ID to which the current identity belongs. |
accessKeyId | The AccessKey ID that belongs to the current identity. - If the requester calls the API by using a software development kit (SDK), this field is recorded. - If the requester logs on to the console, this field is not displayed. - If the requester uses a security token to send the request, the temporary AccessKey ID is recorded. |
userName | The identity name of the current requester. - If type is set to ram-user, this field records the username of the RAM user. - If type is set to assumed-role, this field records RoleName:RoleSessionName. - If type is set to root-account, userName is set to root. - If type is set to cloudsso-user, this field records the username of the CloudSSO user. - If type is set to saml-user, this field records the username of the SAML-based corporate identity. - If type is set to alibaba-cloud-account or system, userName is not recorded. - If type is set to oidc-user, this field records the username of the OIDC-based corporate identity. |
sessionContext | This field is recorded when the requester calls an API operation by using a temporary security token or logs on to the console. This field contains the following information: - creationDate: the time when the session was created. - mfaAuthenticated: indicates whether multi-factor authentication is used when the user logs on to the console. |
Example
{
"eventId": "92b33345-0cef-47be-821f-fb9914d3****",
"eventAttributes": {
"SensitiveAction": "true"
},
"eventVersion": 1,
"sourceIpAddress": "ecs.aliyuncs.com",
"userAgent": "ecs.aliyuncs.com",
"eventRW": "Write",
"eventType": "ApiCall",
"referencedResources": {
"ACS::ECS::Instance": [
"i-8vb0smn1lf6g77md****"
],
"ACS::ECS::Disk": [
"d-8vbf8rpv2nn0l1zm****"
]
},
"userIdentity": {
"type": "system"
},
"serviceName": "Ecs",
"requestId": "32B7EB75-62EE-511E-9449-E19EBF67C2ED",
"eventTime": "2022-10-22T21:52:00Z",
"isGlobal": false,
"acsRegion": "cn-hangzhou",
"eventName": "DeleteDisk"
}