Alibaba CloudOverview
Description
ActionTrail is a web service that records API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the Alibaba Cloud service. ActionTrail provides a history of API calls for an account, including API calls made via the Management Console, SDKs, command line tools.
Rationale
The API call history produced by ActionTrail enables security analysis, resource change tracking, and compliance auditing. Moreover, ensuring that a multi-regions trail exists will ensure that any unexpected activities occurring in otherwise unused regions are detected. Global Service Logging should be enabled by default to capture recording of events generated on Alibaba Cloud global services for a multi-regions trail, therefore, ensuring the recording of management operations that are performed on all resources in an Alibaba Cloud account.
Impact
OSS lifecycle features can be used to manage the accumulation and management of logs over time. See the following resource for more information on these features: http://help.aliyun.com/document_detail/31863.html
Default Value
By default, there are no trails configured. Once the trail is enabled, it applies to all regions by default.
References
Remediation guidance
Perform the following to enable global (Multi-region) ActionTrail logging:
Via the management console
- Login to the
ActionTrail Console - Click on
Trailson the left navigation pane - Click
Add new trail - Enter a trail name in the
Trail name box - Set
Yesto `Apply Trail to All Regions - Specify an OSS bucket name in the OSS bucket box
- Specify an SLS project name in the SLS project box
- Click
Create
Via CLI
aliyuncli actiontrail CreateTrail --Name <trailName> --OssBucketName --RoleName aliyunactiontraildefaultrole
--SlsProjectArn --SlsWriteRoleArn --EventRW
aliyuncli actiontrail UpdateTrail --Name <trailName> --OssBucketName --RoleName aliyunactiontraildefaultrole
--SlsProjectArn --SlsWriteRoleArn --EventRW
Multiple Remediation Paths
SERVICE-WIDE (RECOMMENDED when many resources are affected): Apply organization/tenant-level guardrails and baseline policies for the entire platform.
ASSET-LEVEL: Fix only the affected resources identified by this control.
PREVENTIVE: Add preventive policy checks to CI/CD and periodic posture scans.
References for Service-Wide Patterns
- Platform policy/governance and preventive control patterns should be applied tenant-wide where supported.
Query logic
These are the stored checks tied to this control.
Alibaba ActionTrails that export copies of all log entries
Connectors
Covered asset types
Expected check: eq []
{
AlibabaLogging1 {...AssetFragment}
}
