You can use ActionTrail to audit the operations of your team members. This helps your team members comply with the terms of use of each Alibaba Cloud service. For example, you can use ActionTrail to find the Resource Access Management (RAM) user that performed a specific accidental operation at a specific point in time. This topic describes how to query NAT gateway events in ActionTrail.
Background information
As the team manager, you use an Alibaba Cloud account to create multiple RAM users for your team members and grant the RAM users administrator permissions.
When RAM User A queries the details of a NAT gateway, RAM User A notices that an extra elastic IP address (EIP) is bound to the NAT gateway. All the RAM users have administrator permissions, and you cannot directly determine which RAM user bound the EIP to the NAT gateway. In this case, you can use ActionTrail to query the events and identify the RAM user that bound the EIP to the NAT gateway.
You can click an EIP to view information such as the ID of the EIP.
Procedure
Log on to the ActionTrail console.
In the left-side navigation pane, choose .
In the top navigation bar, select the required region.
Select Resource Name from the drop-down list.
Enter the ID of the EIP in the search box and click the
icon. Find an event and click View Event Details in the Actions column to view the details of the event and the event code.
NoteThe details of the event indicate that RAM User B bound the EIP to the NAT gateway at 16:24:56 on November 2, 2020. This way, you can determine that RAM User B bound the EIP to the NAT gateway of RAM User A.
References
For more information about how to query event details, see Query events in the ActionTrail console.