RAM identities often accumulate more permissions than they need. Access audit shows which permissions each identity has and when they were last used, so you can identify and safely remove unused permissions to enforce least privilege.
Usage notes
Review these considerations before using access audit to modify RAM identity permissions.
Tracking period
Access tracking began on February 1, 2024. Earlier access is not recorded. Last-accessed data may be delayed up to 24 hours.
Access attempts
Last-accessed data includes all API access attempts — not just successful ones — whether made through the console, CLI, SDKs, or direct API calls. An unexpected access attempt does not indicate a compromise; the request may have been denied. Review ActionTrail logs for details on specific requests.
Report owner
Only the entity that generates a report can view its detailed records. On the console, wait for the report to finish generating. When using an API, SDK, or CLI, your credentials must match the report owner's. If you generate a report with an STS token from a RAM role, you must use an STS token from the same role to view it.
Supported policy types
Access audit analyzes only identity-based policies attached to RAM users, user groups, and roles. It does not analyze resource-based policies (such as OSS Bucket Policy), Resource Directory control policies, or session policies.
Supported audit granularities
-
Service level
Analyzes permissions at the cloud service level. View which services a RAM identity can access, which it has accessed, and when. Use this to revoke unused system policies or refine service-level permissions.
Supported services are listed in Services that support access audit.
-
Operation level
Extends service-level analysis to individual API operations. View which operations a RAM identity can perform, which it has performed, and when. Use this for fine-grained permission control or to restrict high-risk operations.
Supported services are marked Operation level in the Audit granularity column of Services that support access audit.
Important-
Access audit covers only control plane operations integrated with ActionTrail. Data plane operations (such as OSS GetObject) are not supported.
-
Access audit does not support permissions that are not associated with a specific API operation, such as
ram:PassRole.
-
Unsupported scenarios
Some services perform permission checks on your behalf when calling other service APIs. For example, Resource Center checks whether you can view resources in a target service and returns only authorized results. These indirect checks are not recorded in access audit data.
The following APIs involve such indirect permission checks.
|
Cloud service |
Service code |
API |
|
Resource Center |
resourcecenter |
SearchResources |
|
GetResourceCounts |
||
|
GetResourceConfiguration |
||
|
ListResourceTypes |
||
|
ExecuteSQLQuery |
||
|
Resource Manager |
resourcemanager |
ListResources |
|
Tag |
tag |
ListTagResources |
|
ListTagKeys |
||
|
ListTagValues |
View audit records for a RAM user
-
Log on to the RAM console as a RAM administrator.
-
In the left-side navigation pane, choose .
-
On the Users page, click the RAM user that you want to audit.
-
On the user details page, click the Policy Access Beta tab.
The system generates an access audit report for the RAM user. This may take a few moments.
-
View the access audit records.
View the cloud services available to the RAM user, the attached policies, and when each service was last accessed.
For services that support operation-level auditing, click View Actions in the Actions column to view allowed operations and their last access time.
View audit records for a RAM role
-
Log on to the RAM console as a RAM administrator.
-
In the left-side navigation pane, choose .
-
On the Roles page, click the RAM role that you want to audit.
-
On the role details page, click the Policy Access Beta tab.
The system generates an access audit report for the RAM role. This may take a few moments.
NoteService-linked roles do not support access audit. The Policy Access Beta tab is not displayed for these roles.
-
View the access audit records.
View the cloud services available to the RAM role, the attached policies, and when each service was last accessed.
For services that support operation-level auditing, click View Actions in the Actions column to view allowed operations and their last access time.
Access audit FAQ
Why is my access audit report empty?
An access audit report may be empty. Check the following:
-
Verify that at least one identity-based policy is attached to the RAM identity — directly, or inherited from a user group for RAM users.
-
Verify that the attached policies grant permissions. The system analyzes all attached policies to determine accessible services and operations.
-
Verify that the granted services or operations are in the list of services that support access audit.
"InvalidParameter.Policy.Statement" error
This error occurs when a permission policy has invalid formatting. The error message names the malformed policy and the reason. Fix the policy format and regenerate the report.
"InvalidParameter.Policy.NotAction" error
This error occurs because a NotAction element in a policy has an invalid value. The error message names the affected policy. Fix the NotAction element and regenerate the report.
"LengthExceedLimit.Policy" error
This error occurs because an attached policy is too large to analyze. The error message names the policy. Split the policy into smaller statements and regenerate the report.
References
-
Services that support access audit lists supported cloud services and their audit granularities.
-
Use the over-privileged analyzer to continuously detect over-privileged RAM identities across your Resource Directory or current account. Detect over-privileged identities.