Yandex Cloud
Search
Contact UsTry it for free
  • Customer Stories
  • Documentation
  • Blog
  • All Services
  • System Status
  • Marketplace
    • Featured
    • Infrastructure & Network
    • Data Platform
    • AI for business
    • Security
    • DevOps tools
    • Serverless
    • Monitoring & Resources
  • All Solutions
    • By industry
    • By use case
    • Economics and Pricing
    • Security
    • Technical Support
    • Start testing with double trial credits
    • Cloud credits to scale your IT product
    • Gateway to Russia
    • Cloud for Startups
    • Center for Technologies and Society
    • Yandex Cloud Partner program
    • Price calculator
    • Pricing plans
  • Customer Stories
  • Documentation
  • Blog
© 2026 Direct Cursus Technology L.L.C.
Yandex Audit Trails
  • Getting started
  • Access management
  • Pricing policy
  • Terraform reference
  • Monitoring metrics
  • Management event reference
  • Data event reference
      • AddressAttached
      • AddressDetached
      • CreateAddress
      • CreateGateway
      • CreateIpfix
      • CreateNetwork
      • CreatePrivateEndpoint
      • CreateRouteTable
      • CreateSecurityGroup
      • CreateSubnet
      • DeleteAddress
      • DeleteGateway
      • DeleteIpfix
      • DeleteNetwork
      • DeletePrivateEndpoint
      • DeleteRouteTable
      • DeleteSecurityGroup
      • DeleteSubnet
      • ExternalFlow
      • GatewayAttached
      • GatewayDetached
      • MoveAddress
      • MoveGateway
      • MoveNetwork
      • MoveRouteTable
      • MoveSecurityGroup
      • MoveSubnet
      • RelocateSubnet
      • RouteTableAttached
      • RouteTableDetached
      • UpdateAddress
      • UpdateGateway
      • UpdateNetwork
      • UpdatePrivateEndpoint
      • UpdateRouteTable
      • UpdateSecurityGroup
      • UpdateSubnet
  • Release notes

In this article:

  • Event JSON schema
  • Field description
  • IamAuthentication
  • IamTokenInfo
  • ResourceMetadata
  • Resource
  • EventDetails
  1. Audit log reference
  2. vpc
  3. CreateIpfix

Virtual Private Cloud Audit Trails Events: CreateIpfix

Written by
Yandex Cloud
Updated at April 15, 2026
  • Event JSON schema
  • Field description
  • IamAuthentication
  • IamTokenInfo
  • ResourceMetadata
  • Resource
  • EventDetails

Event JSON schemaEvent JSON schema

{
  "eventId": "string",
  "eventSource": "string",
  "eventType": "string",
  "eventTime": "string",
  "authentication": {
    "authenticated": "boolean",
    // Includes only one of the fields `subjectType`
    "subjectType": "string",
    // end of the list of possible fields
    // Includes only one of the fields `subjectId`
    "subjectId": "string",
    // end of the list of possible fields
    // Includes only one of the fields `subjectName`
    "subjectName": "string",
    // end of the list of possible fields
    // Includes only one of the fields `federationId`
    "federationId": "string",
    // end of the list of possible fields
    // Includes only one of the fields `federationName`
    "federationName": "string",
    // end of the list of possible fields
    // Includes only one of the fields `federationType`
    "federationType": "string",
    // end of the list of possible fields
    "tokenInfo": {
      "maskedIamToken": "string",
      // Includes only one of the fields `iamTokenId`
      "iamTokenId": "string",
      // end of the list of possible fields
      // Includes only one of the fields `impersonatorId`
      "impersonatorId": "string",
      // end of the list of possible fields
      // Includes only one of the fields `impersonatorType`
      "impersonatorType": "string",
      // end of the list of possible fields
      // Includes only one of the fields `impersonatorName`
      "impersonatorName": "string",
      // end of the list of possible fields
      // Includes only one of the fields `impersonatorFederationId`
      "impersonatorFederationId": "string",
      // end of the list of possible fields
      // Includes only one of the fields `impersonatorFederationName`
      "impersonatorFederationName": "string",
      // end of the list of possible fields
      // Includes only one of the fields `impersonatorFederationType`
      "impersonatorFederationType": "string"
      // end of the list of possible fields
    }
  },
  "resourceMetadata": {
    "path": [
      {
        "resourceType": "string",
        "resourceId": "string",
        // Includes only one of the fields `resourceName`
        "resourceName": "string"
        // end of the list of possible fields
      }
    ]
  },
  "eventStatus": "string",
  "details": {
    "natSrcAddress": "string",
    "natSrcPort": "string",
    "protocol": "string",
    "timestamp": "string",
    "srcAddress": "string",
    "srcPort": "string",
    "dstAddress": "string",
    "dstPort": "string",
    "natDstAddress": "string",
    "natDstPort": "string",
    "vrf": "string",
    "instanceId": "string",
    "interfaceId": "string",
    "subnetId": "string",
    "networkId": "string",
    "natEvent": "string",
    "domainId": "string",
    "agentId": "string",
    "exportSeq": "string",
    "natPool": "string"
  }
}

Field descriptionField description

Field

Description

eventId

string

eventSource

string

eventType

string

eventTime

string (date-time)

String in RFC3339 text format. The range of possible values is from
0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z, i.e. from 0 to 9 digits for fractions of a second.

To work with values in this field, use the APIs described in the
Protocol Buffers reference.
In some languages, built-in datetime utilities do not support nanosecond precision (9 digits).

authentication

IamAuthentication

resourceMetadata

ResourceMetadata

eventStatus

enum (SynchronousEventStatus)

  • ERROR
  • DONE

details

EventDetails

IamAuthenticationIamAuthentication

Field

Description

authenticated

boolean

subjectType

enum (IamSubjectType)

Includes only one of the fields subjectType.

  • YANDEX_PASSPORT_USER_ACCOUNT
  • SERVICE_ACCOUNT
  • FEDERATED_USER_ACCOUNT
  • SSH_USER
  • KUBERNETES_USER

subjectId

string

Includes only one of the fields subjectId.

subjectName

string

Includes only one of the fields subjectName.

federationId

string

Includes only one of the fields federationId.

federationName

string

Includes only one of the fields federationName.

federationType

enum (FederationType)

Includes only one of the fields federationType.

  • GLOBAL_FEDERATION
  • PRIVATE_FEDERATION

tokenInfo

IamTokenInfo

IamTokenInfoIamTokenInfo

Field

Description

maskedIamToken

string

iamTokenId

string

Includes only one of the fields iamTokenId.

impersonatorId

string

Includes only one of the fields impersonatorId.

impersonatorType

enum (IamSubjectType)

Includes only one of the fields impersonatorType.

  • YANDEX_PASSPORT_USER_ACCOUNT
  • SERVICE_ACCOUNT
  • FEDERATED_USER_ACCOUNT
  • SSH_USER
  • KUBERNETES_USER

impersonatorName

string

Includes only one of the fields impersonatorName.

impersonatorFederationId

string

Includes only one of the fields impersonatorFederationId.

impersonatorFederationName

string

Includes only one of the fields impersonatorFederationName.

impersonatorFederationType

enum (FederationType)

Includes only one of the fields impersonatorFederationType.

  • GLOBAL_FEDERATION
  • PRIVATE_FEDERATION

ResourceMetadataResourceMetadata

Field

Description

path[]

Resource

ResourceResource

Field

Description

resourceType

string

resourceId

string

resourceName

string

Includes only one of the fields resourceName.

EventDetailsEventDetails

Field

Description

natSrcAddress

string

natSrcPort

string (int64)

protocol

string (int64)

timestamp

string (date-time)

String in RFC3339 text format. The range of possible values is from
0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z, i.e. from 0 to 9 digits for fractions of a second.

To work with values in this field, use the APIs described in the
Protocol Buffers reference.
In some languages, built-in datetime utilities do not support nanosecond precision (9 digits).

srcAddress

string

srcPort

string (int64)

dstAddress

string

dstPort

string (int64)

natDstAddress

string

natDstPort

string (int64)

vrf

string (int64)

instanceId

string

interfaceId

string (int64)

subnetId

string

networkId

string

natEvent

string (int64)

domainId

string (int64)

agentId

string

exportSeq

string (int64)

natPool

string (int64)

Was the article helpful?

Previous
CreateGateway
Next
CreateNetwork
© 2026 Direct Cursus Technology L.L.C.