Getting started with Audit Trails
Audit Trails collects audit logs from Yandex Cloud resources and uploads them to an Object Storage bucket, a Cloud Logging log group, or a Data Streams data stream.
Within Audit Trails, audit logs are managed by trails.
Follow this guide to create a new trail that will upload audit logs of your organization resources to an Object Storage bucket.
Tip
For additional security of your audit logs, use bucket encryption.
Getting started
-
Go to the management console
and log in to Yandex Cloud or sign up if not signed up yet. -
On the Billing
page, make sure you have a billing account linked and its status isACTIVE
orTRIAL_ACTIVE
. If you do not have a billing account yet, create one. -
Make sure your cloud has a bucket where you can store audit logs. Create a new bucket with restricted access, if required.
-
Assign roles to the service account:
CLIIf you do not have the Yandex Cloud CLI yet, install and initialize it.
The folder specified in the CLI profile is used by default. You can specify a different folder using the
--folder-name
or--folder-id
parameters.-
Assign the
audit-trails.viewer
role for the cloud from whose resources you will collect audit logs:yc resource-manager cloud add-access-binding \ --role audit-trails.viewer \ --id <cloud_ID> \ --service-account-id <service_account_ID>
Where:
--role
: Role being assigned.id
: ID of the cloud whose audit logs will be collected.--service-account-id
: Service account ID.
-
Assign the
storage.uploader
role to the folder to host the trail:yc resource-manager folder add-access-binding \ --role storage.uploader \ --id <folder_ID> \ --service-account-id <service_account_ID>
Where:
--role
: Role being assigned.--id
: ID of the folder to host the trail.--service-account-id
: Service account ID.
-
-
Assign the following roles to your Yandex Cloud account:
iam.serviceAccounts.user
for the service account.audit-trails.editor
for the folder to host the trail.audit-trails.viewer
for the organization whose audit logs will be collected.kms.editor
for the folder where the bucket encryption key will be created.storage.viewer
for the bucket or folder.
Note
If you are unable to manage roles, contact your cloud or organization administrator.
Encrypting a bucket
To store logs in encrypted form:
-
Create a symmetric encryption key in Yandex Key Management Service.
-
Enable bucket encryption using the previously created key.
-
To upload logs to an encrypted bucket, assign the
kms.keys.encrypter
role for the key to the previously created service account:yc kms symmetric-key add-access-binding \ --role kms.keys.encrypter \ --id <key_ID> \ --service-account-id <service_account_ID>
Where:
--role
: Role being assigned.--id
: Encryption key ID.--service-account-id
: Service account ID.
Creating a trail
Note
Changing a destination object in an existing trail may result in a loss of events. Create a new trail if you need to change the destination object safely.
To create your first trail in Audit Trails and start the process of management event audit log management:
-
In the management console
, select the folder to host the trail. -
Select Audit Trails.
-
Click Create trail.
-
In the Name field, enter a name for the trail.
-
In the Description field, enter the trail description (optional).
-
Under Destination, configure the destination object:
- Destination:
Object Storage
. - Bucket: Select the bucket to upload audit logs to.
- Object prefix: Optional parameter used in the full name of the audit log file.
Note
Use a prefix to store audit logs and third-party data in the same bucket. Do not use the same prefix for logs and other bucket objects because that may cause logs and third-party objects to overwrite each other.
- Encryption key: If the bucket you selected is encrypted, specify the encryption key.
- Destination:
-
Under Service account, select the service account that the trail will use to upload audit log files to the bucket.
-
Under Collecting management events, configure the collection of management event audit logs:
- Collecting events: Select
Enabled
. - Resource: Select
Organization
. - Organization: Automatically populated field containing the name of the current organization.
- Cloud: Keep the default value,
All
.
- Collecting events: Select
-
Optionally, under Collecting data events, configure the collection of data event audit logs:
-
Collecting events: Select
Enabled
. -
Select the services to collect audit logs for.
-
For each service you select, specify the audit log collection scope and event filter type:
Receive all
: To receive all events within the service.Selected
: To receive only the selected events. Next, select the events.Exclude
: To receive all events except for the selected ones. Next, select the events.
-
-
Click Create.
If you do not have the Yandex Cloud CLI yet, install and initialize it.
The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name
or --folder-id
parameters.
-
View the description of the CLI command for creating a trail:
yc audit-trails trail create --help
-
Run the command to create a trail to collect management event audit logs in the organization:
yc audit-trails trail create \ --name <trail_name> \ --description "<trail_description>" \ --service-account-id <service_account_ID> \ --destination-bucket <bucket_name> \ --destination-bucket-object-prefix <prefix_in_bucket> \ --filter-from-organisation-id <organization_ID> \ --filter-some-cloud-ids <list_of_clouds_in_organization>
Where:
-
--name
: Name of the trail being created.
The name format requirements are as follows:- It must be 2 to 63 characters long.
- It may contain lowercase Latin letters, numbers, and hyphens.
- It must start with a letter and cannot end with a hyphen.
-
--description
: Description of the trail to distinguish it from other trails, e.g.,--description "My very first trail"
. This is an optional parameter. -
--service-account-id
: ID of the service account that the trail will use to upload audit log files to the bucket.Based on the audit log collection scope, the service account must have the
audit-trails.viewer
role for the organization, cloud, or folder whose audit logs the trail will collect.
-
--destination-bucket
: Name of the bucket to upload audit logs to.
To get a list of buckets in the default folder, run theyc storage bucket list
CLI command. -
--destination-bucket-object-prefix
: Prefix to assign to the objects with audit logs in the bucket. It is an optional parameter used in the full name of the audit log file.Note
Use a prefix to store audit logs and third-party data in the same bucket. Do not use the same prefix for logs and other bucket objects because that may cause logs and third-party objects to overwrite each other.
-
--filter-from-organisation-id
: ID of the organization the new trail belongs to and for whose resources audit logs will be collected.When using the
--filter-from-organisation-id
parameter, you also need to set cloud IDs in the--filter-some-cloud-ids
parameter.You cannot use
--filter-from-organisation-id
together with--filter-all-organisation-id
. -
--filter-some-cloud-ids
: List of IDs of the clouds for whose resources the trail will collect audit logs. Use this parameter only if the--filter-from-organisation-id
parameter is set.The clouds specified in the parameter must belong to the organization named in the
--filter-from-organisation-id
parameter.If you need to collect audit logs in all clouds belonging to an organization, use the
--filter-all-organisation-id
parameter. -
--filter-all-organisation-id
: ID of the organization the new trail belongs to and for whose resources audit logs will be collected from all clouds.You cannot use
--filter-all-organisation-id
together with--filter-from-organisation-id
.
Result:
done (1s) id: cnpe0gldjeq0******** folder_id: b1g9d2k0itu4******** created_at: "2024-03-31T16:54:56.187Z" updated_at: "2024-03-31T16:54:56.187Z" name: sample-trail description: My very first trail destination: object_storage: bucket_id: at-destination-bucket object_prefix: sample-trail-audit-logs service_account_id: ajeee339l4m5******** status: ACTIVE filter: path_filter: root: some_filter: resource: id: bpfaidqca8vd******** type: organization-manager.organization filters: - any_filter: resource: id: b1glti4eser3******** type: resource-manager.cloud - any_filter: resource: id: b1gssd27h7ra******** type: resource-manager.cloud event_filter: {} cloud_id: b1glti4eser3********
For more information about the
yc audit-trails trail create
command, see the CLI reference. -
With Terraform
Terraform is distributed under the Business Source License
For more information about the provider resources, see the documentation on the Terraform
If you don't have Terraform, install it and configure the Yandex Cloud provider.
-
In the configuration file, describe the parameters of the trail that will collect audit events of the organization's resources:
resource "yandex_audit_trails_trail" "basic_trail" { name = "<trail_name>" folder_id = "<folder_ID>" description = "<trail_description>" labels = { key = "value" } service_account_id = "<service_account_ID>" storage_destination { bucket_name = "<bucket_name>" object_prefix = "<prefix_in_bucket>" } filter { path_filter { some_filter { resource_id = "<organization_ID>" resource_type = "<parent_resource_type>" any_filters { resource_id = "<ID_of_cloud_1>" resource_type = "<child_resource_type>" } any_filters { resource_id = "<ID_of_cloud_2>" resource_type = "<child_resource_type>" } } } event_filters { service = "<ID_of_service_1>" categories { plane = "DATA_PLANE" type = "<action_type>" } path_filter { any_filter { resource_id = "<organization_ID>" resource_type = "<resource_type>" } } } event_filters { service = "<ID_of_service_2>" categories { plane = "DATA_PLANE" type = "<action_type>" } path_filter { any_filter { resource_id = "<organization_ID>" resource_type = "<resource_type>" } } } } }
Where:
-
name
: Name of the new trail. The naming requirements are as follows:- It must be 2 to 63 characters long.
- It may contain lowercase Latin letters, numbers, and hyphens.
- It must start with a letter and cannot end with a hyphen.
-
folder_id
: ID of the folder to create the trail in. -
description
: Description of the trail to distinguish it from other trails, e.g.,My very first trail
. This is an optional parameter. -
labels
: List of labels inkey=value
format. This is an optional parameter. -
service_account_id
: ID of the service account the trail will use to upload audit log files to the bucket.Based on the audit log collection scope, the service account must have the
audit-trails.viewer
role for the organization, cloud, or folder whose audit logs the trail will collect.
storage_destination
: Structure describing the target bucket.-
bucket_name
: Name of the bucket to upload audit logs to.
To get a list of buckets in the default folder, run theyc storage bucket list
CLI command. -
object_prefix
: Prefix to assign to the objects with audit logs in the bucket. It is an optional parameter used in the full name of the audit log file.Note
Use a prefix to store audit logs and third-party data in the same bucket. Do not use the same prefix for logs and other bucket objects because that may cause logs and third-party objects to overwrite each other.
-
-
filtering_policy
: Settings of the filtering policy that determines which events to collect and include in the audit logs. The policy consists of filters pertaining to different levels of events. It contains themanagement_events_filter
anddata_events_filters
objects.-
management_events_filter
: Management event filter. -
resource_scopes
: Log collection scope. You can combine several scopes belonging to the same organization in oneresource_scopes
parameter. For example, you can collect logs from one entire cloud and only from particular folders in another cloud. Service account permissions must allow collecting logs from the specified scopes.-
resource_id
: ID of the resource for whose resources audit logs will be collected. Based on the audit log collection scope, specify the organization ID or the cloud ID in this parameter. -
resource_type
: Scope type according to the specified ID:organization-manager.organization
: Organization.resource-manager.cloud
: Cloud.resource-manager.folder
: Folder.
-
-
data_events_filters
: Data event filters. You can configure several filters of this type, one filter per service. A filter for one service has the following structure:service
: Name of the service in which the trail will process events. You can get it from the data event reference.resource_scopes
: Places to collect data events from. You can configure this parameter the same way as the management event filter.included_events
: Collect only specified events. This is an optional parameter. If not specified, all events will be collected. To collect all events except the specified ones, replaceincluded_events
withexcluded_events
. These parameters are mutually exclusive.
You can get a full list of events from the data event reference.
-
For more information about the
yandex_audit_trails_trail
resource parameters in Terraform, see the provider documentation . -
-
Create resources:
-
In the terminal, change to the folder where you edited the configuration file.
-
Make sure the configuration file is correct using the command:
terraform validate
If the configuration is correct, the following message is returned:
Success! The configuration is valid.
-
Run the command:
terraform plan
The terminal will display a list of resources with parameters. No changes are made at this step. If the configuration contains errors, Terraform will point them out.
-
Apply the configuration changes:
terraform apply
-
Confirm the changes: type
yes
in the terminal and press Enter.
Terraform will create all the required resources. You can check the new resources and their settings using the management console
or this CLI command:yc audit-trails trail get <trail_name>
-
Use the create REST API method for the Trail resource or the TrailService/Create gRPC API call.
Viewing audit logs
When uploading audit logs to a bucket, Audit Trails generates audit log files approximately once every 5 minutes. The trail will write all the events that occurred to the organization resources during that period to one or more files. If no events occurred during the period, no files are generated.
Make sure that the audit log file is in the bucket specified when creating the trail.
Viewing audit log files
Audit Trails creates log files in JSON
format.
Access to the contents of the audit log file using one of the following methods:
- Download the object.
- Get a public link to the object.
- Mount the bucket using FUSE
: s3fs or goofys.
Exporting audit logs to SIEM systems
You can export audit log files to your SIEM solution.
What's next
- Learn more about the service.
- Learn more about the types of audit logs.