Configure ActionTrail with Terraform - Simple Log Service

Configure Log Audit Service with Terraform to automate and version-control your audit log collection setup.

Prerequisites

Terraform must be installed and configured. For instructions, see Quickly create resources with Terraform and Install and configure Terraform locally.

Background

Terraform is an open-source tool for safely and efficiently previewing, provisioning, and managing cloud infrastructure and resources. The Terraform command-line interface (CLI) simplifies deploying configuration files to Alibaba Cloud or any other supported cloud and managing them with version control.

terraform-provider-alicloud provides more than 163 resources and 113 data sources across Alibaba Cloud products, including compute, storage, networking, CDN, Container Service, middleware, and databases.

Benefits of Terraform

Deploy infrastructure to multiple clouds

Terraform supports multi-cloud strategies, letting you deploy consistent infrastructure to Alibaba Cloud, other cloud providers, or on-premises data centers with the same tools and configuration files.
Automate infrastructure management

Terraform uses reusable configuration file templates to define, provision, and configure ECS resources repeatably and predictably, reducing manual deployment and management errors. You can deploy the same template multiple times to create identical development, test, and production environments.
Infrastructure as Code

Terraform lets you manage resources as code (Infrastructure as Code), enabling you to version your infrastructure state, track component changes, and share configurations.
Reduce development costs

Reduce development costs by creating on-demand development and deployment environments. You can also estimate costs before applying changes.

Step 1: Configure credentials and the region

Set environment variables for your credentials and the region for the ActionTrail central Project.

export ALICLOUD_ACCESS_KEY="AccessKey ID"
export ALICLOUD_SECRET_KEY="AccessKey Secret"
export ALICLOUD_REGION="cn-huhehaote"

Parameter	Description
ALICLOUD_ACCESS_KEY	The Alibaba Cloud Access Key ID. For more information, see Access Key.
ALICLOUD_SECRET_KEY	The Alibaba Cloud Access Key secret. For more information, see Access Key.
ALICLOUD_REGION	The region for the ActionTrail central Project. The following regions are supported: China: China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Hangzhou), China (Shanghai), China (Shenzhen), and China (Hong Kong) Regions outside China: Singapore, Japan (Tokyo), Germany (Frankfurt), Indonesia (Jakarta), and Malaysia (Kuala Lumpur)

Step 2: RAM authorization

If the AliyunServiceRoleForSLSAudit service-linked role does not exist for your management account, create it. For more information, see initial configuration.

To configure other member accounts by using the custom authorization mode, refer to custom authorization for log collection and synchronization for the required policies.

Step 3: Configure Log Audit Service

Create a Terraform working directory, such as sls, and create a terraform.tf file in it.

In the terraform.tf file, add the following content.

resource "alicloud_log_audit" "example" {
  display_name = "tf-audit-test"
  aliuid       = "1379186349****"
}

The following table describes the parameters.

Parameter	Description
example	A customizable name for the resource.
display_name	A customizable name for the collection configuration.
aliuid	The Alibaba Cloud account ID.

From the sls working directory, run the following command to initialize Terraform.

terraform init

If the output shows Terraform has been successfully initialized!, the initialization is successful.

- Installed hashicorp/alicloud v1.125.0 (signed by HashiCorp)
Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.
Warning: Additional provider information from registry
The remote registry returned warnings for registry.terraform.io/hashicorp/alicloud:
- For users on Terraform 0.13 or greater, this provider has moved to aliyun/alicloud. Please update your
required_providers.
Terraform has been successfully initialized!
You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.
If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

In the terraform.tf file, configure the parameters for Log Audit Service.

The following examples show common configurations. For a complete parameter reference, see Terraform-Aliyun Log Audit.

Single-account collection

resource "alicloud_log_audit" "example" {
  display_name = "tf-audit-test"
  aliuid       = "1379186349****"
  variable_map = {
    "actiontrail_enabled" = "true",
    "actiontrail_ttl" = "180"
  }
}

Multi-account collection

Configure multi-account collection using either custom authorization management mode, where the central account is a standard account, or Resource Directory management mode, where the central account must be a management account or a delegated administrator account. For more information, see Configure multi-account collection.

Custom authorization management mode

resource "alicloud_log_audit" "example" {
  display_name = "tf-audit-test"
  aliuid     = "1379186349****"
  variable_map = {
    "actiontrail_enabled" = "true",
    "actiontrail_ttl" = "180"
  }
  multi_account = ["1257918632****", "1324567349****"]
}

Resource Directory management mode (custom)

resource "alicloud_log_audit" "example" {
  display_name = "tf-audit-test"
  aliuid    = "1379186349****"
  variable_map = {
    "actiontrail_enabled" = "true",
    "actiontrail_ttl" = "180"
  }
  multi_account = ["1257918632****", "1324567349****"]
resource_directory_type="custom"
}

Resource Directory management mode (all)

resource "alicloud_log_audit" "example" {
  display_name = "tf-audit-test"
  aliuid       = "1379186349****"
  variable_map = {
    "actiontrail_enabled" = "true",
    "actiontrail_ttl" = "180"
  }
resource_directory_type="all"
}

The following table describes the key parameters.

Parameter	Description
multi_account	When configuring multi-account collection by using the custom authorization management mode or the custom mode of the Resource Directory management mode, you must set the multi_account parameter. Note The custom authorization management mode is complex. We recommend using the Resource Directory management mode for multi-account configurations. Custom authorization management mode (the resource_directory_type parameter is not specified): Set multi_account to the Alibaba Cloud account IDs. Resource Directory management mode (custom) (resource_directory_type=custom): Set multi_account to the IDs of the members in your Resource Directory.
resource_directory_type	When using the Resource Directory management mode for multi-account collection, you must set the resource_directory_type parameter. Valid values: `all`: Use the all-members mode of Resource Directory. `custom`: Use the custom mode of Resource Directory. Note If you use the custom authorization management mode, you do not need to specify the resource_directory_type parameter.
variable_map	Specifies settings for collection objects, collection status, and the data retention period. For a list of variable_map parameters, see Appendix: variable_map parameter list.

Apply the collection configuration in the terraform.tf file.

Run the following command.
```
terraform apply
```

Enter yes.

If the response contains Apply complete!, the collection configuration is applied successfully, and the Log Audit Service will collect and store logs based on the configuration.

Plan: 1 to add, 0 to change, 0 to destroy.
Do you want to perform these actions?
    Terraform will perform the actions described above.
    Only 'yes' will be accepted to approve.
    Enter a value: yes
alicloud_log_audit.example: Creating...
alicloud_log_audit.example: Creation complete after 3s [id=tf-audit-test]
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Related actions

Terraform also supports the following operations.

Import an existing collection configuration.
```
terraform import alicloud_log_audit.example tf-audit-test
```
```
alicloud_log_audit.example: Importing from ID "tf-audit-test"...
alicloud_log_audit.example: Import prepared!
  Prepared alicloud_log_audit for import
alicloud_log_audit.example: Refreshing state... [id=tf-audit-test]

Import successful!

Resources imported:
  alicloud_log_audit.example
```
Replace example and tf-audit-test with your actual values.

After the command runs, you can view the imported collection configuration in the terraform.tfstate file in the Terraform working directory.
Important
- To migrate the imported collection configuration to the terraform.tf file, you must manually copy it and adjust its format to meet the requirements of the terraform.tf file.
- If you have already run the terraform apply or terraform import command in the current Terraform working directory, running the terraform import command again will fail. You must delete the terraform.tfstate file in the current directory before running the terraform import command again.

View the current collection configuration.

terraform show

# alicloud_log_audit.example:
resource "alicloud_log_audit" "example" {
    aliuid       = "xxx"
    display_name = "tf-audit-test"
    id           = "tf-audit-test"
    variable_map = {
        "actiontrail_enabled" = "true"
        "actiontrail_ttl"     = "180"
    }
}

View the differences between the terraform.tf file and the applied collection configuration.

terraform plan

xxx@QPJTMD6M-0104 code % terraform plan
alicloud_log_audit.example: Refreshing state... [id=tf-audit-test]
Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following
symbols:
  ~ update in-place
Terraform will perform the following actions:
  # alicloud_log_audit.example will be updated in-place
  ~ resource "alicloud_log_audit" "example" {
        id              = "tf-audit-test"
      ~ variable_map = {
          ~ "actiontrail_ttl"    = "180" -> "7"
          + "oss_access_enabled" = "true"
          + "oss_access_ttl"     = "180"
            # (1 unchanged element hidden)
        }
        # (2 unchanged attributes hidden)
    }
Plan: 0 to add, 1 to change, 0 to destroy.

Log audit in an intranet environment

To configure log audit in an intranet environment, follow these steps:

Use version 1.214.0 or later of the alicloud provider.
Use the endpoints block to set the correct endpoint. For example, to use the intranet environment in the China (Beijing) region, set the endpoint to cn-beijing-intranet.log.aliyuncs.com. For more information, see Endpoints.

Example

This example shows how to configure log audit in the China (Beijing) intranet environment:

terraform {
     required_providers {
          alicloud = { 
               version = "1.214.0" // Use version 1.214.0 or later of the Terraform alicloud provider.
          }   
     }   
}
provider "alicloud" {
    endpoints {
        log = "cn-beijing-intranet.log.aliyuncs.com"// Set this to the endpoint for your region.
    }
}
resource "alicloud_log_audit" "example" {
    display_name = "tf-audit-test"
    aliuid       = "148*******3782"
    variable_map = {
        "actiontrail_enabled" = "true",
        "actiontrail_ttl" ="30"
    }
}

Upgrade the Terraform alicloud provider.
```
terraform init --upgrade
```
Apply the configuration.
```
terraform apply
```

Example

Log Audit collection policies in Terraform require special attention to character escaping and multiline configurations. For example, to collect logs only from VPC instances where the env tag is test, set the collection policy as follows.

accept tag.env == "test"
drop "*"

Because collection policies can span multiple lines and contain special characters such as double quotes ("), they require special handling. The Log Service console handles character escaping automatically, but when using Terraform, you must manually escape characters and add line breaks. Two approaches are available.

Use a heredoc string. For more information, see multiline configuration.

variable "vpcflow_policy" {
  type        = string
  default     = <<EOF
accept tag.env == \"test\"
drop \"*\"
EOF
}
resource "alicloud_log_audit" "example" {
  display_name = "tf-audit-test"
  aliuid       = "1234************"
  variable_map = {
    "vpc_flow_enabled" = "true",
    "vpc_flow_ttl" = "7",
    "vpc_sync_enabled" = "true",
    "vpc_sync_ttl" = "180",
    "vpc_flow_collection_policy" = var.vpcflow_policy
  }
  #if using rd custom mode for multi-account
  multi_account = ["1235************","1236************"]
  resource_directory_type="custom"
}

Properly escape backslashes (\) and double quotes ("), and use \n for line breaks. For more information, see Escaping characters.

resource "alicloud_log_audit" "example" {
  display_name = "tf-audit-test"
  aliuid       = "1234************"
  variable_map = {
    "vpc_flow_enabled" = "true",
    "vpc_flow_ttl" = "7",
    "vpc_sync_enabled" = "true",
    "vpc_sync_ttl" = "180",
    "vpc_flow_collection_policy" = "accept tag.env == \\\"test\\\"\\ndrop \\\"*\\\""
  }
  #if using rd custom mode for multi-account
  multi_account = ["1235************","1236************"]
  resource_directory_type="custom"
}

`variable_map` parameters

Parameter	Description	Default
actiontrail_enabled	Specifies whether to collect ActionTrail audit logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
actiontrail_ttl	Specifies the retention period for the centralized storage of ActionTrail audit logs, in days.	180
cloudconfig_change_enabled	Specifies whether to collect Cloud Config change logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
cloudconfig_change_ttl	Specifies the retention period for the centralized storage of Cloud Config change logs, in days.	180
cloudconfig_noncom_enabled	Specifies whether to collect Cloud Config non-compliant events. Valid values: `true`: Enables collection. `false`: Disables collection.	false
cloudconfig_noncom_ttl	Specifies the retention period for the centralized storage of Cloud Config non-compliant events, in days.	180
oss_access_enabled	Specifies whether to collect OSS access logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
oss_access_ttl	Specifies the retention period for the regional storage of OSS access logs, in days.	7
oss_sync_enabled	Specifies whether to sync OSS access logs to a central location. Valid values: `true`: Enables syncing. `false`: Disables syncing.	true
oss_sync_ttl	Specifies the retention period for the centralized storage of OSS access logs, in days.	180
oss_metering_enabled	Specifies whether to collect OSS metering logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
oss_metering_ttl	Specifies the retention period for the centralized storage of OSS metering logs, in days.	180
rds_enabled	Specifies whether to collect RDS for MySQL audit logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
rds_audit_collection_policy	Specifies the collection policy for RDS for MySQL audit logs.	""
rds_ttl	Specifies the retention period for the centralized storage of RDS for MySQL audit logs, in days.	180
rds_slow_enabled	Specifies whether to collect RDS for MySQL slow logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
rds_slow_collection_policy	Specifies the collection policy for RDS for MySQL slow logs.	""
rds_slow_ttl	Specifies the retention period for the centralized storage of RDS for MySQL slow logs, in days.	180
rds_error_enabled	Specifies whether to collect RDS for MySQL error logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
rds_error_collection_policy	Specifies the collection policy for RDS for MySQL error logs.	""
rds_error_ttl	Specifies the retention period for the centralized storage of RDS for MySQL error logs, in days.	180
rds_perf_enabled	Specifies whether to collect RDS for MySQL performance logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
rds_perf_collection_policy	Specifies the collection policy for RDS for MySQL performance logs.	""
rds_perf_ttl	Specifies the retention period for the centralized storage of RDS for MySQL performance logs, in days.	180
vpc_flow_enabled	Specifies whether to collect VPC flow logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
vpc_flow_ttl	Specifies the retention period for the regional storage of VPC flow logs, in days.	7
vpc_flow_collection_policy	Specifies the collection policy for VPC flow logs.	""
vpc_sync_enabled	Specifies whether to sync VPC flow logs to a central location. Valid values: `true`: Enables syncing. `false`: Disables syncing.	true
vpc_sync_ttl	Specifies the retention period for the centralized storage of VPC flow logs, in days.	180
dns_gtm_collection_policy	Specifies the collection policy for DNS Global Traffic Manager logs.	""
dns_gtm_ttl	Specifies the retention period for DNS Global Traffic Manager logs, in days.	180
dns_gtm_enabled	Specifies whether to collect DNS Global Traffic Manager logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
dns_resolve_collection_policy	Specifies the collection policy for public DNS resolution logs.	""
dns_resolve_ttl	Specifies the retention period for public DNS resolution logs, in days.	180
dns_resolve_enabled	Specifies whether to collect public DNS resolution logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
dns_intranet_enabled	Specifies whether to collect private DNS logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
dns_intranet_ttl	Specifies the retention period for the regional storage of private DNS logs, in days.	7
dns_intranet_collection_policy	Specifies the collection policy for private DNS logs.	""
dns_sync_enabled	Specifies whether to sync private DNS logs to a central location. Valid values: `true`: Enables syncing. `false`: Disables syncing.	true
dns_sync_ttl	Specifies the retention period for the centralized storage of private DNS logs, in days.	180
polardb_enabled	Specifies whether to collect PolarDB for MySQL audit logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
polardb_audit_collection_policy	Specifies the collection policy for PolarDB for MySQL audit logs.	""
polardb_ttl	Specifies the retention period for the centralized storage of PolarDB for MySQL audit logs, in days.	180
polardb_slow_enabled	Specifies whether to collect PolarDB for MySQL slow logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
polardb_slow_collection_policy	Specifies the collection policy for PolarDB for MySQL slow logs.	""
polardb_slow_ttl	Specifies the retention period for the centralized storage of PolarDB for MySQL slow logs, in days.	180
polardb_error_enabled	Specifies whether to collect PolarDB for MySQL error logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
polardb_error_collection_policy	Specifies the collection policy for PolarDB for MySQL error logs.	""
polardb_error_ttl	Specifies the retention period for the centralized storage of PolarDB for MySQL error logs, in days.	180
polardb_perf_enabled	Specifies whether to collect PolarDB for MySQL performance logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
polardb_perf_collection_policy	Specifies the collection policy for PolarDB for MySQL performance logs.	""
polardb_perf_ttl	Specifies the retention period for the centralized storage of PolarDB for MySQL performance logs, in days.	180
drds_audit_enabled	Specifies whether to collect PolarDB-X 1.0 audit logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
drds_audit_collection_policy	Specifies the collection policy for PolarDB-X 1.0 audit logs.	""
drds_audit_ttl	Specifies the retention period for the regional storage of PolarDB-X 1.0 audit logs, in days.	7
drds_sync_enabled	Specifies whether to sync PolarDB-X 1.0 audit logs to a central location. Valid values: `true`: Enables syncing. `false`: Disables syncing.	true
drds_sync_ttl	Specifies the retention period for the centralized storage of PolarDB-X 1.0 audit logs, in days.	180
slb_access_enabled	Specifies whether to collect SLB access logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
slb_access_collection_policy	Specifies the collection policy for SLB access logs.	""
slb_access_ttl	Specifies the retention period for the regional storage of SLB access logs, in days.	7
slb_sync_enabled	Specifies whether to sync SLB access logs to a central location. Valid values: `true`: Enables syncing. `false`: Disables syncing.	true
slb_sync_ttl	Specifies the retention period for the centralized storage of SLB access logs, in days.	180
alb_access_enabled	Specifies whether to collect ALB access logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
alb_access_collection_policy	Specifies the collection policy for ALB access logs.	""
alb_access_ttl	Specifies the retention period for the regional storage of ALB access logs, in days.	7
alb_sync_enabled	Specifies whether to sync ALB access logs to a central location. Valid values: `true`: Enables syncing. `false`: Disables syncing.	true
alb_sync_ttl	Specifies the retention period for the centralized storage of ALB access logs, in days.	180
bastion_enabled	Specifies whether to collect Bastionhost operation logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
bastion_ttl	Specifies the retention period for the centralized storage of Bastionhost operation logs, in days.	180
waf_enabled	Specifies whether to collect WAF access logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
waf_ttl	Specifies the retention period for the centralized storage of WAF access logs, in days.	180
cloudfirewall_enabled	Specifies whether to collect Cloud Firewall internet firewall flow logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
cloudfirewall_ttl	Specifies the retention period for the centralized storage of Cloud Firewall internet firewall flow logs, in days.	180
cloudfirewall_vpc_enabled	Specifies whether to collect Cloud Firewall VPC firewall flow logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
cloudfirewall_vpc_ttl	Specifies the retention period for the centralized storage of Cloud Firewall VPC firewall flow logs, in days.	180
ddos_coo_access_enabled	Specifies whether to collect Anti-DDoS Pro access logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
ddos_coo_access_ttl	Specifies the retention period for the centralized storage of Anti-DDoS Pro access logs, in days.	180
ddos_bgp_access_enabled	Specifies whether to collect Anti-DDoS Origin access logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
ddos_bgp_access_ttl	Specifies the retention period for the centralized storage of Anti-DDoS Origin access logs, in days.	180
ddos_dip_access_enabled	Specifies whether to collect Anti-DDoS Premium access logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
ddos_dip_access_ttl	Specifies the retention period for the centralized storage of Anti-DDoS Premium access logs, in days.	180
sas_file_detect_enabled	Specifies whether to collect Security Center file detection logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
sas_client_enabled	Specifies whether to collect Security Center agent event logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
sas_net_block_enabled	Specifies whether to collect Security Center network protection logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
sas_rasp_enabled	Specifies whether to collect Security Center application protection logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
sas_cspm_enabled	Specifies whether to collect Cloud Security Posture Management (CSPM) logs from Security Center. Valid values: `true`: Enables collection. `false`: Disables collection.	false
sas_ttl	Specifies the retention period for the centralized storage of Security Center logs, in days.	180
sas_process_enabled	Specifies whether to collect Security Center process startup logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
sas_network_enabled	Specifies whether to collect Security Center network connection logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
sas_login_enabled	Specifies whether to collect Security Center logon logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
sas_crack_enabled	Specifies whether to collect Security Center brute-force attack logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
sas_snapshot_process_enabled	Specifies whether to collect Security Center process snapshot logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
sas_snapshot_account_enabled	Specifies whether to collect Security Center account snapshot logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
sas_snapshot_port_enabled	Specifies whether to collect Security Center port snapshot logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
sas_dns_enabled	Specifies whether to collect Security Center DNS resolution logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
sas_local_dns_enabled	Specifies whether to collect Security Center local DNS logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
sas_session_enabled	Specifies whether to collect Security Center network session logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
sas_http_enabled	Specifies whether to collect Security Center web access logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
sas_security_vul_enabled	Specifies whether to collect Security Center vulnerability logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
sas_security_hc_enabled	Specifies whether to collect Security Center security baseline logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
sas_security_alert_enabled	Specifies whether to collect Security Center alert logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
sas_dns_query_enabled	Specifies whether to collect Security Center DNS query logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
apigateway_enabled	Specifies whether to collect API Gateway access logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
apigateway_ttl	Specifies the retention period for the centralized storage of API Gateway access logs, in days.	180
nas_enabled	Specifies whether to collect NAS access logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
nas_ttl	Specifies the retention period for the centralized storage of NAS access logs, in days.	180
appconnect_enabled	Specifies whether to collect App Integration logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
appconnect_ttl	Specifies the retention period for the centralized storage of App Integration logs, in days.	180
cps_enabled	Specifies whether to collect Mobile Push logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
cps_ttl	Specifies the retention period for the centralized storage of Mobile Push logs, in days.	180
k8s_audit_enabled	Specifies whether to collect Kubernetes audit logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
k8s_audit_collection_policy	Specifies the collection policy for Kubernetes audit logs.	""
k8s_audit_ttl	Specifies the retention period for the centralized storage of Kubernetes audit logs, in days.	180
k8s_event_enabled	Specifies whether to collect Kubernetes event logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
k8s_event_collection_policy	Specifies the collection policy for Kubernetes event logs.	""
k8s_event_ttl	Specify the centralized storage duration for Kubernetes event logs, in days.	180
k8s_ingress_enabled	Specifies whether to collect Kubernetes Ingress access logs. Valid values: `true`: Enables collection. `false`: Disables collection.	false
k8s_ingress_collection_policy	Specifies the collection policy for Kubernetes Ingress access logs.	""
k8s_ingress_ttl	Specifies the retention period for the centralized storage of Kubernetes Ingress access logs, in days.	180

Prerequisites

Background

Benefits of Terraform

Step 1: Configure credentials and the region

Step 2: RAM authorization

Step 3: Configure Log Audit Service

Related actions

Log audit in an intranet environment

Example

Example

variable_map parameters

`variable_map` parameters