Instance audit

Field name

Example

Detailed explanation

access_credential_type

Password

Type of credential.

• Password: Fixed password.

• TemporaryToken: Temporary password.

action

GetImageManifest

Type of operation.

• GetImageManifest: Retrieve image Manifest.

• GetBlob: Retrieve image Blob.

• PutImageManifest: Push image Manifest.

• DeleteTag: Delete image version.

blob_digest

sha256:4f4fxxxx

A unique identifier generated based on the hash of the Blob content.

http_request_host

demo-registry.cn-hangzhou.cr.aliyuncs.com

Request endpoint.

http_request_id

718e09d1-aab5-xxxxx

Request ID.

http_request_method

GET

HTTP request method.

http_request_remote_vpc_id

vpc-xxxxxx

Client VPC address.

http_request_remoteaddr

140.xx.xx.xx

Client IP address.

http_request_useragent

docker/24.0.2

The User-Agent header in the HTTP request.

http_response_status

200

The HTTP status code.

instance_id

cri-xxx

The ID of the instance.

namespace

test-ns

The namespace to which the image repository belongs.

repo

test-repo

The name of the image repository.

namespace_repo

test-ns/test-repo

The full name of the image repository.

network_type

Internet

Type of access network.

• Internet: Public network.

• VPC: Virtual private cloud (VPC).

tag

v1

Image version.

time

2024-04-12T16:58:30.855892463+08:00

The time when the server received the request.

user_identity_account_id

135668xxxxxxx

The ID of the Alibaba Cloud account of the requester.

user_identity_player_account_id

149134xxxxxxx

The ID of the player account.

user_identity_principal_id

300786xxxxxxx:Alice

The ID of the current requester. You need to combine it with user_identity_user_type to uniquely identify the requester.

• If the value of the event.userIdentity.type field is root-account, this field is set to the ID of the Alibaba Cloud account.

• If the value of the event.userIdentity.type field is ram-user, this field is set to the ID of the Resource Access Management (RAM) user.

• If the value of the event.userIdentity.type field is assumed-role, this field is set to RoleID:RoleSessionName.

user_identity_role_id

300786xxxxxxx

The role ID.

user_identity_role_name

teststs

The role name.

user_identity_user_type

assumed-role

The type of the identity.

• root-account: indicates an Alibaba Cloud account.

• ram-user: indicates a RAM user.

• assumed-role: indicates a RAM role.

• system: indicates an ACR service call.

user_name

sub_user@xxxx

The instance logon name.