Control: 2.1 Ensure that ActionTrail are configured to export copies of all Log entries

Description

ActionTrail is a web service that records API calls for your account and delivers log files to you. The recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the Alibaba Cloud service. ActionTrail provides a history of API calls for an account, including API calls made via the Management Console, SDKs, command line tools.

Remediation

Perform the following to enable global (Multi-region) ActionTrail logging:

From Console

1. Logon to ActionTrail Console.
2. Click on Trails on the left navigation pane.
3. Click Add new trail.
   • Enter a trail name in the Trail name box.
   • Set Yes for Apply Trail to All Regions.
   • Specify an OSS bucket name in the OSS bucket box.
   • Specify an SLS project name in the SLS project box.
   • Click Create.

From Command Line

aliyuncli actiontrail CreateTrail --Name <trail_name> --OssBucketName <oss_bucket_for_actiontrail> --RoleName aliyunactiontraildefaultrole --SlsProjectArn <sls_project_arn_for_actiontrail> --SlsWriteRoleArn <sls_role_arn_for_actiontrail> --EventRW <api_type_for_actiontrail>

aliyuncli actiontrail UpdateTrail --Name <trail_name> --OssBucketName <oss_bucket_for_actiontrail> --RoleName aliyunactiontraildefaultrole --SlsProjectArn <sls_project_arn_for_actiontrail> --SlsWriteRoleArn <sls_role_arn_for_actiontrail> --EventRW <api_type_for_actiontrail>