Yandex Cloud
Search
Contact UsGet started
  • Blog
  • Pricing
  • Documentation
  • All Services
  • System Status
    • Featured
    • Infrastructure & Network
    • Data Platform
    • Containers
    • Developer tools
    • Serverless
    • Security
    • Monitoring & Resources
    • ML & AI
    • Business tools
  • All Solutions
    • By industry
    • By use case
    • Economics and Pricing
    • Security
    • Technical Support
    • Customer Stories
    • Gateway to Russia
    • Cloud for Startups
    • Education and Science
  • Blog
  • Pricing
  • Documentation
Yandex project
© 2025 Yandex.Cloud LLC
Yandex Audit Trails
  • Getting started
  • Access management
  • Pricing policy
  • Terraform reference
  • Monitoring metrics
  • Management event reference
  • Data event reference
  • Release notes

In this article:

  • Getting started
  • Encrypting a bucket
  • Creating a trail
  • Viewing audit logs
  • Viewing audit log files
  • Exporting audit logs to SIEM systems
  • What's next

Getting started with Audit Trails

Written by
Yandex Cloud
Improved by
Danila N.
Updated at May 5, 2025
  • Getting started
  • Encrypting a bucket
  • Creating a trail
  • Viewing audit logs
    • Viewing audit log files
  • Exporting audit logs to SIEM systems
  • What's next

Audit Trails collects audit logs from Yandex Cloud resources and uploads them to an Object Storage bucket, a Cloud Logging log group, or a Data Streams data stream.

Within Audit Trails, audit logs are managed by trails.

Follow this guide to create a new trail that will upload audit logs of your organization resources to an Object Storage bucket.

Tip

For additional security of your audit logs, use bucket encryption.

Getting startedGetting started

  1. Go to the management console and log in to Yandex Cloud or sign up if not signed up yet.

  2. On the Yandex Cloud Billing page, make sure you have a billing account linked and its status is ACTIVE or TRIAL_ACTIVE. If you do not have a billing account yet, create one.

  3. Make sure your cloud has a bucket where you can store audit logs. Create a new bucket with restricted access, if required.

  4. Assign roles to the service account:

    CLI

    If you do not have the Yandex Cloud CLI yet, install and initialize it.

    The folder specified when creating the CLI profile is used by default. To change the default folder, use the yc config set folder-id <folder_ID> command. You can specify a different folder using the --folder-name or --folder-id parameter.

    • Assign the audit-trails.viewer role for the cloud from whose resources you will collect audit logs:

      yc resource-manager cloud add-access-binding \
        --role audit-trails.viewer \
        --id <cloud_ID> \
        --service-account-id <service_account_ID>
      

      Where:

      • --role: Role being assigned.
      • id: ID of the cloud whose audit logs will be collected.
      • --service-account-id: Service account ID.
    • Assign the storage.uploader role to the folder to host the trail:

      yc resource-manager folder add-access-binding \
        --role storage.uploader \
        --id <folder_ID> \
        --service-account-id <service_account_ID>
      

      Where:

      • --role: Role being assigned.
      • --id: ID of the folder to host the trail.
      • --service-account-id: Service account ID.
  5. Assign the following roles to your Yandex Cloud account:

    • iam.serviceAccounts.user for the service account.
    • audit-trails.editor for the folder to host the trail.
    • audit-trails.viewer for the organization whose audit logs will be collected.
    • kms.editor for the folder where the bucket encryption key will be created.
    • storage.viewer for the bucket or folder.

    Note

    If you are unable to manage roles, contact your cloud or organization administrator.

Encrypting a bucketEncrypting a bucket

To store logs in encrypted form:

  1. Create a symmetric encryption key in Yandex Key Management Service.

  2. Enable bucket encryption using the previously created key.

  3. To upload logs to an encrypted bucket, assign the kms.keys.encrypter role for the key to the previously created service account:

    yc kms symmetric-key add-access-binding \
        --role kms.keys.encrypter \
        --id <key_ID> \
        --service-account-id <service_account_ID>
    

    Where:

    • --role: Role being assigned.
    • --id: Encryption key ID.
    • --service-account-id: Service account ID.

Creating a trailCreating a trail

Note

Changing a destination object in an existing trail may result in a loss of events. Create a new trail if you need to change the destination object safely.

To create your first trail in Audit Trails and start the process of management event audit log management:

Management console
CLI
Terraform
API
  1. In the management console, select the folder to host the trail.

  2. Select Audit Trails.

  3. Click Create trail.

  4. In the Name field, enter a name for the trail.

  5. In the Description field, enter the trail description (optional).

  6. Under Destination, configure the destination object:

    • Destination: Object Storage.
    • Bucket: Select the bucket to upload audit logs to.
    • Object prefix: Optional parameter used in the full name of the audit log file.

    Note

    Use a prefix to store audit logs and third-party data in the same bucket. Do not use the same prefix for logs and other bucket objects because that may cause logs and third-party objects to overwrite each other.

    • Encryption key: If the bucket you selected is encrypted, specify the encryption key.
  7. Under Service account, select the service account that the trail will use to upload audit log files to the bucket.

  8. Under Collecting management events, configure the collection of management event audit logs:

    • Collecting events: Select Enabled.
    • Resource: Select Organization.
    • Organization: Automatically populated field containing the name of the current organization.
    • Cloud: Keep the default value, All.
  9. Optionally, under Collecting data events, configure the collection of data event audit logs:

    • Collecting events: Select Enabled.

    • Select the services to collect audit logs for.

    • For each service you select, specify the audit log collection scope and event filter type:

      • Receive all: To receive all events within the service.
      • Selected: To receive only the selected events. Next, select the events.
      • Exclude: To receive all events except for the selected ones. Next, select the events.
  10. Click Create.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder specified when creating the CLI profile is used by default. To change the default folder, use the yc config set folder-id <folder_ID> command. You can specify a different folder using the --folder-name or --folder-id parameter.

  1. View the description of the CLI command for creating a trail:

    yc audit-trails trail create --help
    
  2. Run the command to create a trail to collect management event audit logs in the organization:

    yc audit-trails trail create \
      --name <trail_name> \
      --description "<trail_description>" \
      --service-account-id <service_account_ID> \
      --destination-bucket <bucket_name> \
      --destination-bucket-object-prefix <prefix_in_bucket> \
      --filter-from-organisation-id <organization_ID> \
      --filter-some-cloud-ids <list_of_clouds_in_organization>
    

    Where:

    • --name: Name of the trail being created.
      The name format requirements are as follows:

      • It must be from 2 to 63 characters long.
      • It may contain lowercase Latin letters, numbers, and hyphens.
      • It must start with a letter and cannot end with a hyphen.
    • --description: Description of the trail to distinguish it from other trails, e.g., --description "My very first trail". This is an optional parameter.

    • --service-account-id: ID of the service account that the trail will use to upload audit log files to the bucket.

      Based on the audit log collection scope, the service account must have the audit-trails.viewer role for the organization, cloud, or folder whose audit logs the trail will collect.

    • --destination-bucket: Name of the bucket to upload audit logs to.
      To get a list of buckets in the default folder, run the yc storage bucket list CLI command.

    • --destination-bucket-object-prefix: Prefix to assign to the objects with audit logs in the bucket. It is an optional parameter used in the full name of the audit log file.

      Note

      Use a prefix to store audit logs and third-party data in the same bucket. Do not use the same prefix for logs and other bucket objects because that may cause logs and third-party objects to overwrite each other.

    • --filter-from-organisation-id: ID of the organization the new trail belongs to and for whose resources audit logs will be collected.

      When using the --filter-from-organisation-id parameter, you also need to set cloud IDs in the --filter-some-cloud-ids parameter.

      You cannot use --filter-from-organisation-id together with --filter-all-organisation-id.

    • --filter-some-cloud-ids: List of IDs of the clouds for whose resources the trail will collect audit logs. Use this parameter only if the --filter-from-organisation-id parameter is set.

      The clouds specified in the parameter must belong to the organization named in the --filter-from-organisation-id parameter.

      If you need to collect audit logs in all clouds belonging to an organization, use the --filter-all-organisation-id parameter.

    • --filter-all-organisation-id: ID of the organization the new trail belongs to and for whose resources audit logs will be collected from all clouds.

      You cannot use --filter-all-organisation-id together with --filter-from-organisation-id.

    Result:

    done (1s)
    id: cnpe0gldjeq0********
    folder_id: b1g9d2k0itu4********
    created_at: "2024-03-31T16:54:56.187Z"
    updated_at: "2024-03-31T16:54:56.187Z"
    name: sample-trail
    description: My very first trail
    destination:
      object_storage:
        bucket_id: at-destination-bucket
        object_prefix: sample-trail-audit-logs
    service_account_id: ajeee339l4m5********
    status: ACTIVE
    filter:
      path_filter:
        root:
          some_filter:
            resource:
              id: bpfaidqca8vd********
              type: organization-manager.organization
            filters:
              - any_filter:
                  resource:
                    id: b1glti4eser3********
                    type: resource-manager.cloud
              - any_filter:
                  resource:
                    id: b1gssd27h7ra********
                    type: resource-manager.cloud
      event_filter: {}
    cloud_id: b1glti4eser3********
    

    For more information about the yc audit-trails trail create command, see the CLI reference.

With Terraform, you can quickly create a cloud infrastructure in Yandex Cloud and manage it using configuration files. These files store the infrastructure description written in HashiCorp Configuration Language (HCL). If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.

Terraform is distributed under the Business Source License. The Yandex Cloud provider for Terraform is distributed under the MPL-2.0 license.

For more information about the provider resources, see the documentation on the Terraform website or mirror website.

If you do not have Terraform yet, install it and configure its Yandex Cloud provider.

  1. In the configuration file, describe the parameters of the trail that will collect audit events of the organization's resources:

    resource "yandex_audit_trails_trail" "basic_trail" {
      name = "<trail_name>"
      folder_id   = "<folder_ID>"
      description = "<trail_description>"
      
      labels = {
        key = "value"
      }
      
      service_account_id = "<service_account_ID>"
      
      storage_destination {
        bucket_name   = "<bucket_name>"
        object_prefix = "<prefix_in_bucket>"
      }
      
      filter {
        path_filter {
          some_filter {
            resource_id   = "<organization_ID>"
            resource_type = "<parent_resource_type>"
            any_filters {
                resource_id   = "<ID_of_cloud_1>"
                resource_type = "<child_resource_type>"
            }
            any_filters {
                resource_id   = "<ID_of_cloud_2>"
                resource_type = "<child_resource_type>"
            }
          }
        }
        event_filters {
          service = "<ID_of_service_1>"
          categories {
            plane = "DATA_PLANE"
            type  = "<action_type>"
          }
          path_filter {
            any_filter {
              resource_id = "<organization_ID>"
              resource_type = "<resource_type>"
            }
          }
        }
        event_filters {
          service = "<ID_of_service_2>"
          categories {
            plane = "DATA_PLANE"
            type  = "<action_type>"
          }
          path_filter {
            any_filter {
              resource_id = "<organization_ID>"
              resource_type = "<resource_type>"
            }
          }
        }
      }
    }
    

    Where:

    • name: Name of the new trail. The naming requirements are as follows:

      • It must be from 2 to 63 characters long.
      • It may contain lowercase Latin letters, numbers, and hyphens.
      • It must start with a letter and cannot end with a hyphen.
    • folder_id: ID of the folder to create the trail in.

    • description: Description of the trail to distinguish it from other trails, e.g., My very first trail. This is an optional parameter.

    • labels: List of labels in key=value format. This is an optional parameter.

    • service_account_id: ID of the service account the trail will use to upload audit log files to the bucket.

      Based on the audit log collection scope, the service account must have the audit-trails.viewer role for the organization, cloud, or folder whose audit logs the trail will collect.

    • storage_destination: Structure describing the target bucket.
      • bucket_name: Name of the bucket to upload audit logs to.
        To get a list of buckets in the default folder, run the yc storage bucket list CLI command.

      • object_prefix: Prefix to assign to the objects with audit logs in the bucket. It is an optional parameter used in the full name of the audit log file.

        Note

        Use a prefix to store audit logs and third-party data in the same bucket. Do not use the same prefix for logs and other bucket objects because that may cause logs and third-party objects to overwrite each other.

    • filtering_policy: Settings of the filtering policy that determines which events to collect and include in the audit logs. The policy consists of filters pertaining to different levels of events. It contains the management_events_filter and data_events_filters objects.

      • management_events_filter: Management event filter.

      • resource_scopes: Log collection scope. You can combine several scopes belonging to the same organization in one resource_scopes parameter. For example, you can collect logs from one entire cloud and only from particular folders in another cloud. Service account permissions must allow collecting logs from the specified scopes.

        • resource_id: ID of the resource for whose resources audit logs will be collected. Based on the audit log collection scope, specify the organization ID or the cloud ID in this parameter.

        • resource_type: Scope type according to the specified ID:

          • organization-manager.organization: Organization.
          • resource-manager.cloud: Cloud.
          • resource-manager.folder: Folder.
      • data_events_filters: Data event filters. You can configure several filters of this type, one filter per service. A filter for one service has the following structure:

        • service: Name of the service in which the trail will process events. You can get it from the data event reference.
        • resource_scopes: Places to collect data events from. You can configure this parameter the same way as the management event filter.
        • included_events: Collect only specified events. This is an optional parameter. If not specified, all events will be collected. To collect all events except the specified ones, replace included_events with excluded_events. These parameters are mutually exclusive.
          You can get a full list of events from the data event reference.

    For more information about the yandex_audit_trails_trail resource parameters in Terraform, see the provider documentation.

  2. Create resources:

    1. In the terminal, change to the folder where you edited the configuration file.

    2. Make sure the configuration file is correct using the command:

      terraform validate
      

      If the configuration is correct, the following message is returned:

      Success! The configuration is valid.
      
    3. Run the command:

      terraform plan
      

      The terminal will display a list of resources with parameters. No changes are made at this step. If the configuration contains errors, Terraform will point them out.

    4. Apply the configuration changes:

      terraform apply
      
    5. Confirm the changes: type yes in the terminal and press Enter.

    Terraform will create all the required resources. You can check the new resources and their settings using the management console or this CLI command:

    yc audit-trails trail get <trail_name>
    

Use the create REST API method for the Trail resource or the TrailService/Create gRPC API call.

Viewing audit logsViewing audit logs

When uploading audit logs to a bucket, Audit Trails generates audit log files approximately once every 5 minutes. The trail will write all the events that occurred to the organization resources during that period to one or more files. If no events occurred during the period, no files are generated.

Make sure that the audit log file is in the bucket specified when creating the trail.

Viewing audit log filesViewing audit log files

Audit Trails creates log files in JSON format.

Access to the contents of the audit log file using one of the following methods:

  • Download the object.
  • Get a public link to the object.
  • Mount the bucket using FUSE: s3fs or goofys.

Exporting audit logs to SIEM systemsExporting audit logs to SIEM systems

You can export audit log files to your SIEM solution.

What's nextWhat's next

  • Learn more about the service.
  • Learn more about the types of audit logs.

Was the article helpful?

Next
All guides
Yandex project
© 2025 Yandex.Cloud LLC