All Products
Search
Document Center

Object Storage Service:Access tracking (Go SDK V2)

Last Updated:Mar 20, 2026

Access tracking records every request made to a bucket, giving you a detailed audit trail for security reviews, compliance reporting, and usage analysis. Use the OSS SDK for Go V2 to enable access tracking on a bucket and confirm it is active.

Prerequisites

Before you begin, make sure you have:

Usage notes

  • The sample code uses the region ID cn-hangzhou (China (Hangzhou)) and public endpoints. To access OSS from another Alibaba Cloud service in the same region, use an internal endpoint instead. For a full list of regions and endpoints, see OSS regions and endpoints.

  • Credentials are read from environment variables at runtime. Avoid hardcoding credentials in source code.

Enable access tracking

package main

import (
	"context"
	"flag"
	"log"

	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss"
	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/credentials"
)

// Define global variables.
var (
	region     string // The bucket region.
	bucketName string // The bucket name.
)

// The init function initializes command-line parameters.
func init() {
	flag.StringVar(&region, "region", "", "The region in which the bucket is located.")
	flag.StringVar(&bucketName, "bucket", "", "The name of the bucket.")
}

// The main function enables access tracking for the bucket.
func main() {
	// Parse command-line parameters.
	flag.Parse()

	// Check whether the bucket name is empty.
	if len(bucketName) == 0 {
		flag.PrintDefaults()
		log.Fatalf("invalid parameters, bucket name required")
	}

	// Check whether the region is empty.
	if len(region) == 0 {
		flag.PrintDefaults()
		log.Fatalf("invalid parameters, region required")
	}

	// Load the default configurations, and set the credential provider and region.
	cfg := oss.LoadDefaultConfig().
		WithCredentialsProvider(credentials.NewEnvironmentVariableCredentialsProvider()).
		WithRegion(region)

	// Create an OSS client.
	client := oss.NewClient(cfg)

	// Create a request to enable access tracking for the bucket.
	request := &oss.PutBucketAccessMonitorRequest{
		Bucket: oss.Ptr(bucketName),
		AccessMonitorConfiguration: &oss.AccessMonitorConfiguration{
			Status: oss.AccessMonitorStatusEnabled, // Enable access tracking.
		},
	}

	// Execute the operation to enable access tracking for the bucket.
	putResult, err := client.PutBucketAccessMonitor(context.TODO(), request)
	if err != nil {
		log.Fatalf("failed to put bucket access monitor %v", err)
	}

	// Print the result.
	log.Printf("put bucket access monitor result: %#v\n", putResult)
}

Verify that access tracking is enabled

After enabling access tracking, query the bucket to confirm the access tracking configuration.

package main

import (
	"context"
	"flag"
	"log"

	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss"
	"github.com/aliyun/alibabacloud-oss-go-sdk-v2/oss/credentials"
)

// Define global variables.
var (
	region     string // The bucket region.
	bucketName string // The bucket name.
)

// The init function initializes command-line parameters.
func init() {
	flag.StringVar(&region, "region", "", "The region in which the bucket is located.")
	flag.StringVar(&bucketName, "bucket", "", "The name of the bucket.")
}

func main() {
	// Parse command-line parameters.
	flag.Parse()

	// Check whether the bucket name is empty.
	if len(bucketName) == 0 {
		flag.PrintDefaults()
		log.Fatalf("invalid parameters, bucket name required")
	}

	// Check whether the region is empty.
	if len(region) == 0 {
		flag.PrintDefaults()
		log.Fatalf("invalid parameters, region required")
	}

	// Load the default configurations, and set the credential provider and region.
	cfg := oss.LoadDefaultConfig().
		WithCredentialsProvider(credentials.NewEnvironmentVariableCredentialsProvider()).
		WithRegion(region)

	// Create an OSS client.
	client := oss.NewClient(cfg)

	// Create a request to query the access tracking configuration of the bucket.
	request := &oss.GetBucketAccessMonitorRequest{
		Bucket: oss.Ptr(bucketName),
	}

	// Execute the operation to query the access tracking configuration and process the result.
	result, err := client.GetBucketAccessMonitor(context.TODO(), request)
	if err != nil {
		log.Fatalf("failed to get bucket access monitor %v", err)
	}

	// Print the result.
	log.Printf("get bucket access monitor result:%#v\n", result)
}

API reference