ActionTrail events - - Alibaba Cloud Documentation Center

This topic describes the types of ActionTrail events that can be published to EventBridge.

Background information

ActionTrail can be used as an event source for the following Alibaba Cloud services.

Alibaba Cloud services

File Storage NAS (NAS)

Server Load Balancer (SLB)

Alibaba Cloud CDN (CDN)

Elasticsearch

DataV

Cloud Enterprise Network (CEN)

ApsaraDB for HBase

Key Management Service (KMS)

ApsaraDB RDS

Container Service for Kubernetes (ACK)

Elastic Compute Service (ECS)

PolarDB for MySQL

ApsaraMQ for Kafka

ActionTrail

Resource Orchestration Service (ROS)

Function Compute

Smart Access Gateway

Cloud Config

ApsaraDB for Cassandra

Virtual Private Cloud (VPC)

Blockchain as a Service (BaaS)

Object Storage Service (OSS)

Resource Access Management (RAM)

Tablestore

CloudMonitor

Batch Compute

Dynamic Content Delivery Network (DCDN)

Auto Scaling

Elastic Container Instance

Container Registry

Interactive Analysis

ApsaraVideo Media Processing

AnalyticDB for MySQL

CloudOps Orchestration Service (OOS)

Security Center (SAS)

E-MapReduce

Fraud Detection

Domains

Data Transmission Service (DTS)

Quick BI

ApsaraVideo VOD (VOD)

ApsaraVideo Live

IoT Platform

Elastic High Performance Computing (E-HPC)

Event types

The following table describes the types of ActionTrail events that can be published to EventBridge.

Event type	Value of the type parameter
An operation is performed on a resource	actiontrail:ActionTrail:AliyunServiceEvent
An API is called	actiontrail:ActionTrail:ApiCall
An operation is performed in the console	actiontrail:ActionTrail:ConsoleOperation

For more information about the parameters defined in the CloudEvents specification, see Overview.

Important

EventBridge supports only ActionTrail events of the write type.

An API operation is called

The following code provides a sample ActionTrail event that is received by EventBridge when an API operation is called:

{
  "eventId": "92b33345-0cef-47be-821f-fb9914d3****",
  "eventAttributes": {
    "SensitiveAction": "true"
  },
  "eventVersion": 1,
  "sourceIpAddress": "ecs.aliyuncs.com",
  "userAgent": "ecs.aliyuncs.com",
  "eventRW": "Write",
  "eventType": "ApiCall",
  "referencedResources": {
    "ACS::ECS::Instance": [
      "i-8vb0smn1lf6g77md****"
    ],
    "ACS::ECS::Disk": [
      "d-8vbf8rpv2nn0l1zm****"
    ]
  },
  "userIdentity": {
    "type": "system",
    "userName": "ecs.aliyuncs.com"
  },
  "serviceName": "Ecs",
  "extend": "INSTANCE",
  "requestId": "32B7EB75-62EE-511E-9449-E19EBF67C2ED",
  "eventTime": "2022-10-22T21:52:00Z",
  "isGlobal": false,
  "acsRegion": "cn-hangzhou",
  "eventName": "DeleteDisk"
}

For information about the fields in the preceding example, see Management event structure.

Note

For information about new fields that are added to ActionTrail events, see Announcement: ActionTrail will add new fields to event logs.