ActionTrail:Use ActionTrail to monitor RAM user creation

Create an alert rule

1. Log on to the ActionTrail console.

2. In the left navigation pane, click Event Alerting.

3. On the Alert Rules tab, click Create Alert and follow the prompts to configure the rule.

   Note the following parameters. Configure other parameters as needed.

   Configuration Item	Requirement
   Query Statistics	Set the Logstore to be the same as the destination SLS Logstore for the trail created in Step 1. The format is actiontrail_Trail name. Set the query statement to: (event.serviceName:Ram or event.serviceName:Ims) and event.eventName:CreateUser | SELECT "event.userIdentity.principalId" as operator, "event.resourceName" as user, date_format(__time__, '%Y-%m-%d %H:%i:%s') as time Note The preceding statement queries for RAM user creation events using the event.serviceName field to specify the Alibaba Cloud service and the event.eventName field to specify the operation. The SELECT statement retrieves information from the event, such as the operator, the created account, and the operation time, to include in the alert notification. For more information about the Alibaba Cloud services and operations that ActionTrail supports, see Supported Alibaba Cloud services. For the definition of the ActionTrail management event structure, see Management event structure. For more information about the SLS query syntax, see Query syntax and functions.
   Trigger Condition	Set Trigger Condition to "Data is available". Set Alert Severity as needed.

4. Click OK.

Create an alert content template

1. In the left navigation pane, click Event Alerting.

2. On the Alert Center page, choose Notification Policy > Content Template.

3. On the Content Template management page, click Create and configure the content template.

   Set the content template type to Text Message and set the content to the following:

   Alibaba Cloud User: {{ alert.aliuid }}
   Alert Rule Name: {{ alert.alert_name }}
   Alert Severity: {{ alert.severity | format_severity }}
   {% for result in alert.fire_results %}
   Operator: {{ result.operator }} created RAM user: {{ result.user }} at {{ result.time }}
   {% endfor %}

   Note

   In the content template, {{ parameter_name }} references a template variable. The {% for result in alert.fire_results %} statement iterates through all query results. Use {{ result.parameter_name }} to retrieve a specific parameter from the event. For more information about content template parameters and syntax, see Content template syntax (new version).

4. Click Confirm.

Create an alert notification recipient

1. In the left navigation pane, click Event Alerting.

2. On the Alert Center page, choose Notification Recipient > User Management.

3. On the User Management page, click Create. In the Add User panel, enter the required information.

   • Phone Number: The mobile phone number that receives alert information. This setting must be enabled to receive alerts.

   • Enable: This must be enabled to receive alerts.

4. Click the Confirm button.

Create an action policy

1. In the left navigation pane, click Event Alerting.

2. On the Alert Center page, go to Notification Policy > Action Policy.

3. On the Action Policy page, click Create. In the Add Action Policy panel, enter the required information.

   In the first action list, configure the condition and action group.

   Configuration Item	Requirement
   Condition Settings	Click the icon. In the Condition dialog box, select the monitoring rule that you created in Create an alert rule.
   Action Group	Set Channel to Text Message. Set Recipient to the user created in Create an alert contact.

4. Click Confirm.

Enable the alert and associate the action policy

1. In the left navigation pane, click Event Alerting.

2. On the Alert Center page, click the Alert Rules tab.

3. Find the rule you created in the Create an alert rule step and click Edit in the Actions column. In the Alerting and Monitoring Rule settings panel, enable alerting and associate an action policy.

   Configuration Item	Requirement
   Output Destination	Switch to SLS Notification.
   Enable	The status of the monitoring rule. Switch this to the enabled state.
   Alert Policy	Policy Type: Select Standard Mode. Action Policy: Select the action policy that you created in Create an action policy.

4. Click Confirm.

A RAM user receives a 'no permission' error when creating a trail in the ActionTrail console.

If you use a RAM user to perform this configuration, you must grant the RAM user the required permissions to access and manage ActionTrail. For more information, see Grant permissions to a RAM user.