Yandex Cloud
Search
Contact UsTry it for free
  • Customer Stories
  • Documentation
  • Blog
  • All Services
  • System Status
  • Marketplace
    • Featured
    • Infrastructure & Network
    • Data Platform
    • AI for business
    • Security
    • DevOps tools
    • Serverless
    • Monitoring & Resources
  • All Solutions
    • By industry
    • By use case
    • Economics and Pricing
    • Security
    • Technical Support
    • Start testing with double trial credits
    • Cloud credits to scale your IT product
    • Gateway to Russia
    • Cloud for Startups
    • Center for Technologies and Society
    • Yandex Cloud Partner program
    • Price calculator
    • Pricing plans
  • Customer Stories
  • Documentation
  • Blog
© 2026 Direct Cursus Technology L.L.C.
Yandex Audit Trails
  • Getting started
  • Access management
  • Pricing policy
  • Terraform reference
  • Monitoring metrics
  • Management event reference
  • Data event reference
      • AddressAttached
      • AddressDetached
      • CreateAddress
      • CreateGateway
      • CreateIpfix
      • CreateNetwork
      • CreatePrivateEndpoint
      • CreateRouteTable
      • CreateSecurityGroup
      • CreateSubnet
      • DeleteAddress
      • DeleteGateway
      • DeleteIpfix
      • DeleteNetwork
      • DeletePrivateEndpoint
      • DeleteRouteTable
      • DeleteSecurityGroup
      • DeleteSubnet
      • ExternalFlow
      • GatewayAttached
      • GatewayDetached
      • MoveAddress
      • MoveGateway
      • MoveNetwork
      • MoveRouteTable
      • MoveSecurityGroup
      • MoveSubnet
      • RelocateSubnet
      • RouteTableAttached
      • RouteTableDetached
      • UpdateAddress
      • UpdateGateway
      • UpdateNetwork
      • UpdatePrivateEndpoint
      • UpdateRouteTable
      • UpdateSecurityGroup
      • UpdateSubnet
  • Release notes

In this article:

  • Event JSON schema
  • Field description
  • ResourceMetadata
  • Resource
  • AggregatedFlowEventDetails
  1. Audit log reference
  2. vpc
  3. ExternalFlow

Virtual Private Cloud Audit Trails Events: ExternalFlow

Written by
Yandex Cloud
Updated at April 15, 2026
  • Event JSON schema
  • Field description
  • ResourceMetadata
  • Resource
  • AggregatedFlowEventDetails

Event JSON schemaEvent JSON schema

{
  "eventId": "string",
  "eventSource": "string",
  "eventType": "string",
  "eventTime": "string",
  "resourceMetadata": {
    "path": [
      {
        "resourceType": "string",
        "resourceId": "string",
        // Includes only one of the fields `resourceName`
        "resourceName": "string"
        // end of the list of possible fields
      }
    ]
  },
  "eventStatus": "string",
  "details": {
    "ifaceIdx": "string",
    "ifaceGen": "string",
    "session": "string",
    "flowIdx": "string",
    "action": "string",
    "vers": "string",
    "proto": "string",
    "srcAddr": "string",
    "dstAddr": "string",
    "direction": "string",
    "reason": "string",
    "nat": "string",
    "srcPort": "string",
    "dstPort": "string",
    "aggStart": "string",
    "aggEnd": "string",
    "packets": "string",
    "bytes": "string",
    "tcpFlags": "string",
    "vmUuid": "string",
    "subnetId": "string"
  }
}

Field descriptionField description

Field

Description

eventId

string

eventSource

string

eventType

string

eventTime

string (date-time)

String in RFC3339 text format. The range of possible values is from
0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z, i.e. from 0 to 9 digits for fractions of a second.

To work with values in this field, use the APIs described in the
Protocol Buffers reference.
In some languages, built-in datetime utilities do not support nanosecond precision (9 digits).

resourceMetadata

ResourceMetadata

eventStatus

enum (SynchronousEventStatus)

  • ERROR
  • DONE

details

AggregatedFlowEventDetails

ResourceMetadataResourceMetadata

Field

Description

path[]

Resource

ResourceResource

Field

Description

resourceType

string

resourceId

string

resourceName

string

Includes only one of the fields resourceName.

AggregatedFlowEventDetailsAggregatedFlowEventDetails

Field

Description

ifaceIdx

string (int64)

ifaceGen

string (int64)

session

string (int64)

flowIdx

string (int64)

action

string

vers

string (int64)

proto

string (int64)

srcAddr

string

dstAddr

string

direction

string

reason

string

nat

string

srcPort

string (int64)

dstPort

string (int64)

aggStart

string (date-time)

String in RFC3339 text format. The range of possible values is from
0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z, i.e. from 0 to 9 digits for fractions of a second.

To work with values in this field, use the APIs described in the
Protocol Buffers reference.
In some languages, built-in datetime utilities do not support nanosecond precision (9 digits).

aggEnd

string (date-time)

String in RFC3339 text format. The range of possible values is from
0001-01-01T00:00:00Z to 9999-12-31T23:59:59.999999999Z, i.e. from 0 to 9 digits for fractions of a second.

To work with values in this field, use the APIs described in the
Protocol Buffers reference.
In some languages, built-in datetime utilities do not support nanosecond precision (9 digits).

packets

string (int64)

bytes

string (int64)

tcpFlags

string

vmUuid

string

subnetId

string

Was the article helpful?

Previous
DeleteSubnet
Next
GatewayAttached
© 2026 Direct Cursus Technology L.L.C.