Getting started with Audit Trails
Audit Trails collects audit logs from Yandex Cloud resources and uploads them to an Object Storage bucket, a Cloud Logging log group, or a Data Streams data stream.
Within Audit Trails, audit logs are managed by trails.
Follow this guide to create a new trail that will upload audit logs of your organization resources to an Object Storage bucket.
Tip
For additional security of your audit logs, use bucket encryption.
Getting started
-
Go to the management console
and sign in to Yandex Cloud or sign up if you are not signed up yet. -
On the Billing
page, make sure you have a billing account linked and it has theACTIVE
orTRIAL_ACTIVE
status. If you do not yet have a billing account, create one. -
Make sure your cloud has a bucket where you can store audit logs. Create a new bucket with restricted access, if required.
-
Assign roles to the service account:
CLIIf you do not have the Yandex Cloud command line interface yet, install and initialize it.
The folder specified in the CLI profile is used by default. You can specify a different folder using the
--folder-name
or--folder-id
parameter.-
Assign the
audit-trails.viewer
role for the cloud from whose resources you will collect audit logs:yc resource-manager cloud add-access-binding \ --role audit-trails.viewer \ --id <cloud_ID> \ --service-account-id <service_account_ID>
Where:
--role
: Role being assigned.id
: ID of the cloud whose audit logs will be collected.--service-account-id
: Service account ID.
-
Assign the
storage.uploader
role to the folder to host the trail:yc resource-manager folder add-access-binding \ --role storage.uploader \ --id <folder_ID> \ --service-account-id <service_account_ID>
Where:
--role
: Role being assigned.--id
: ID of the folder to host the trail.--service-account-id
: Service account ID.
-
-
On the Access management
page, make sure you have the following roles:iam.serviceAccounts.user
for the service account.audit-trails.editor
for the folder to host the trail.audit-trails.viewer
for the organization whose audit logs will be collected.kms.editor
for the folder where the bucket encryption key will be created.storage.viewer
for the bucket or folder.
Encrypting a bucket
To store logs in encrypted form:
-
Create a symmetric encryption key in Yandex Key Management Service.
-
Enable bucket encryption using the previously created key.
-
To upload logs to an encrypted bucket, assign the
kms.keys.encrypter
role for the key to the previously created service account:yc kms symmetric-key add-access-binding \ --role kms.keys.encrypter \ --id <key_ID> \ --service-account-id <service_account_ID>
Where:
--role
: Role being assigned.--id
: Encryption key ID.--service-account-id
: Service account ID.
Creating a trail
Note
Changing a destination object in an existing trail may result in a loss of events. Create a new trail if you need to change the destination object safely.
To create your first trail in Audit Trails and start the process of management event audit log management:
-
In the management console
, select the folder to host the trail. -
Select Audit Trails.
-
Click Create trail.
-
In the Name field, enter a name for the trail.
-
In the Description field, enter the trail description (optional).
-
Under Destination, configure the destination object:
- Destination:
Object Storage
. - Bucket: Select the bucket to upload audit logs to.
- Object prefix: Optional parameter used in the full name of the audit log file.
Note
Use a prefix to store audit logs and third-party data in the same bucket. Do not use the same prefix for logs and other bucket objects because that may cause logs and third-party objects to overwrite each other.
- Encryption key: If the bucket you selected is encrypted, specify the encryption key.
- Destination:
-
Under Service account, select the service account that the trail will use to upload audit log files to the bucket.
-
Under Collecting management events, configure the collection of management event audit logs:
- Collecting events: Select
Enabled
. - Resource: Select
Organization
. - Organization: Automatically populated field containing the name of the current organization.
- Cloud: Keep the default value,
All
.
- Collecting events: Select
-
Optionally, under Collecting data events, configure the collection of data event audit logs:
-
Collecting events: Select
Enabled
. -
Select the services to collect audit logs for.
-
For each service you select, specify the audit log collection scope and event filter type:
Receive all
: To receive all events within the service.Selected
: To receive only the selected events. Next, select the events.Exclude
: To receive all events except for the selected ones. Next, select the events.
-
-
Click Create.
If you do not have the Yandex Cloud command line interface yet, install and initialize it.
The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name
or --folder-id
parameter.
-
View the description of the CLI command for creating a trail:
yc audit-trails trail create --help
-
Run the command to create a trail to collect management event audit logs in the organization:
yc audit-trails trail create \ --name <trail_name> \ --description "<trail_description>" \ --service-account-id <service_account_ID> \ --destination-bucket <bucket_name> \ --destination-bucket-object-prefix <bucket_prefix> \ --filter-from-organisation-id <organization_ID> \ --filter-some-cloud-ids <list_of_clouds_in_the_organization>
Where:
-
--name
: Name of the trail being created.
The name format requirements are as follows:- The name must be from 3 to 63 characters long.
- It may contain lowercase Latin letters, numbers, and hyphens.
- The first character must be a letter and the last character cannot be a hyphen.
-
--description
: Description of the trail to distinguish it from other trails, e.g.,--description "My very first trail"
. This is an optional parameter. -
--service-account-id
: ID of the service account that the trail will use to upload audit log files to the bucket.Based on the audit log collection scope, the service account must have the
audit-trails.viewer
role for the organization, cloud, or folder whose audit logs the trail will collect.
-
--destination-bucket
: Name of the bucket to upload audit logs to.
To get a list of buckets in the default folder, run theyc storage bucket list
CLI command. -
--destination-bucket-object-prefix
: Prefix to assign to the objects with audit logs in the bucket. It is an optional parameter used in the full name of the audit log file.Note
Use a prefix to store audit logs and third-party data in the same bucket. Do not use the same prefix for logs and other bucket objects because that may cause logs and third-party objects to overwrite each other.
-
--filter-from-organisation-id
: ID of the organization the trail being created belongs to and for whose resources audit logs will be collected. You can get the organization ID in the Yandex Cloud Organization console or using theyc organization-manager organization list
CLI command.When using the
--filter-from-organisation-id
parameter, you also need to set cloud IDs in the--filter-some-cloud-ids
parameter.You cannot use the
--filter-from-organisation-id
parameter together with the--filter-all-organisation-id
parameter. -
--filter-some-cloud-ids
: List of IDs of the clouds for whose resources the trail will collect audit logs. Use this parameter only if the--filter-from-organisation-id
parameter is set.The clouds specified in the parameter must belong to the organization set in the
--filter-from-organisation-id
parameter.If you need to collect audit logs from all clouds belonging to the organization, use the
--filter-all-organisation-id
parameter. -
--filter-all-organisation-id
: ID of the organization the trail being created belongs to and for whose resources audit logs will be collected from all clouds.You can get the organization ID in the Yandex Cloud Organization
console or using theyc organization-manager organization list
CLI command.You cannot use the
--filter-all-organisation-id
parameter together with the--filter-from-organisation-id
parameter.
Result:
done (1s) id: cnpe0gldjeq0******** folder_id: b1g9d2k0itu4******** created_at: "2024-03-31T16:54:56.187Z" updated_at: "2024-03-31T16:54:56.187Z" name: sample-trail description: My very first trail destination: object_storage: bucket_id: at-destination-bucket object_prefix: sample-trail-audit-logs service_account_id: ajeee339l4m5******** status: ACTIVE filter: path_filter: root: some_filter: resource: id: bpfaidqca8vd******** type: organization-manager.organization filters: - any_filter: resource: id: b1glti4eser3******** type: resource-manager.cloud - any_filter: resource: id: b1gssd27h7ra******** type: resource-manager.cloud event_filter: {} cloud_id: b1glti4eser3********
For more information about the
yc audit-trails trail create
command, see the CLI reference. -
Terraform
For more information about the provider resources, see the documentation on the Terraform
If you change the configuration files, Terraform automatically detects which part of your configuration is already deployed, and what should be added or removed.
If you don't have Terraform, install it and configure the Yandex Cloud provider.
-
In the configuration file, describe the parameters of the trail that will collect audit events of the organization's resources:
resource "yandex_audit_trails_trail" "basic_trail" { name = "<trail_name>" folder_id = "<folder_ID>" description = "<trail_description>" labels = { key = "value" } service_account_id = "<service_account_ID>" storage_destination { bucket_name = "<bucket_name>" object_prefix = "<bucket_prefix>" } filter { path_filter { some_filter { resource_id = "<organization_ID>" resource_type = "<parent_resource_type>" any_filters { resource_id = "<cloud_1_ID>" resource_type = "<child_resource_type>" } any_filters { resource_id = "<cloud_2_ID>" resource_type = "<child_resource_type>" } } } event_filters { service = "<service_1_ID>" categories { plane = "DATA_PLANE" type = "<action_type>" } path_filter { any_filter { resource_id = "<organization_ID>" resource_type = "<resource_type>" } } } event_filters { service = "<service_2_ID>" categories { plane = "DATA_PLANE" type = "<action_type>" } path_filter { any_filter { resource_id = "<organization_ID>" resource_type = "<resource_type>" } } } } }
Where:
-
name
: Name of the trail being created. The name format requirements are as follows:- The name must be from 3 to 63 characters long.
- It may contain lowercase Latin letters, numbers, and hyphens.
- The first character must be a letter and the last character cannot be a hyphen.
-
folder_id
: ID of the folder to create a trail in. -
description
: Description of the trail to distinguish it from other trails, e.g.,My very first trail
. This is an optional parameter. -
labels
: List of labels inkey=value
format. This is an optional parameter. -
service_account_id
: ID of the service account that the trail will use to upload audit log files to the bucket.Based on the audit log collection scope, the service account must have the audit-trails.viewer
role
for the organization, cloud, or folder whose audit logs the trail will collect.
storage_destination
: Structure describing the target bucket.-
bucket_name
: Name of the bucket to upload audit logs to.
To get a list of buckets in the default folder, run theyc storage bucket list
CLI command. -
object_prefix
: Prefix to assign to the objects with audit logs in the bucket. It is an optional parameter used in the full name of the audit log file.Note
Use a prefix to store audit logs and third-party data in the same bucket. Do not use the same prefix for logs and other bucket objects because that may cause logs and third-party objects to overwrite each other.
-
filter
: Structure describing how the trail processes events. It contains thepath_filter
andevent_filters
objects.-
path_filter
: Structure describing how the trail processes management (control plane) events. It may contain a singlesome_filter
object or a singleany_filter
object. If thepath_filter
object is missing in the configuration, the trail will not process control plane events. -
event_filters
: Structure describing how the trail processes data (data plane) evens. If theevent_filters
object is missing in the configuration, the trail will not process data plane events. A singleevent_filters
section is used to configure data plane audit log processing for a single Yandex Cloud service. To configure the trail processing of data plane events for multiple services, specify theevent_filters
parameter in the configuration as many times as you need.-
service
: ID of the service whose events the trail will process.
The possible values include:dns
kms
lockbox
mdb.mongodb
mdb.mysql
mdb.postgresql
storage
-
categories
: Structure describing the type of events to collect.plane
: Event plane. For data plane events, specifyDATA_PLANE
.type
: Type of resource event action. The possible values areREAD
andWRITE
.
-
path_filter
: Structure describing how the trail processes data (data plane) events. It may contain a singlesome_filter
object or a singleany_filter
object.
-
-
For more information about the parameters of the
yandex_audit_trails_trail
resource in Terraform, see the provider documentation . -
-
Create resources:
-
In the terminal, change to the folder where you edited the configuration file.
-
Make sure the configuration file is correct using the command:
terraform validate
If the configuration is correct, the following message is returned:
Success! The configuration is valid.
-
Run the command:
terraform plan
The terminal will display a list of resources with parameters. No changes are made at this step. If the configuration contains errors, Terraform will point them out.
-
Apply the configuration changes:
terraform apply
-
Confirm the changes: type
yes
in the terminal and press Enter.
Terraform will create all the required resources. You can check the new resources and their configuration using the management console
or this CLI command:yc audit-trails trail get <trail_name>
-
Use the create REST API method for the Trail resource or the TrailService/Create gRPC API call.
Viewing audit logs
When uploading audit logs to a bucket, Audit Trails generates audit log files approximately once every 5 minutes. The trail will write all the events that occurred to the organization resources during that period to one or more files. If no events occurred during the period, no files are generated.
Make sure that the audit log file is in the bucket specified when creating the trail.
Viewing audit log files
Audit Trails creates log files in JSON
format.
Access to the contents of the audit log file using one of the following methods:
- Download the object.
- Get a public link to the object.
- Mount the bucket using FUSE
: s3fs or goofys.
Exporting audit logs to SIEM systems
You can export audit log files to your SIEM solution.
What's next
- Learn more about the service.
- Learn more about the types of audit logs.