Configuring Yandex Query

Yandex Query supports Audit Trails. You can analyze events of Yandex Cloud resources by running analytical and streaming YQL queries.

You can run analytical queries for logs stored in a bucket, and streaming queries for logs stored in Yandex Data Streams.

To connect a bucket with audit logs to Yandex Query and run YQL queries:

1. Set up your environment.
2. Create a connection between the trail and YQ.
3. Run a query to logs in Object Storage.

If you no longer need the resources you created, delete them.

Getting startedGetting started

Sign up for Yandex Cloud and create a billing account:

1. Navigate to the management console and log in to Yandex Cloud or create a new account.
2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one and link a cloud to it.

If you have an active billing account, you can navigate to the cloud page to create or select a folder for your infrastructure.

Learn more about clouds and folders here.

If you do not have the Yandex Cloud CLI installed yet, install and initialize it.

Required paid resourcesRequired paid resources

The cost of infrastructure support includes a bucket use fee (see Object Storage pricing).

Set up your environmentSet up your environment

Create a bucket for audit logsCreate a bucket for audit logs

Create service accountsCreate service accounts

Create a service account named trail-sa:

Similarly, create a service account named bucket-yq-sa.

Assign permissions to service accountsAssign permissions to service accounts

Assign the audit-trails.viewer and storage.uploader roles to the trail-sa service account:

Assign the storage.viewer role for example-folder to the bucket-yq-sa service account:

yc resource-manager folder add-access-binding example-folder \
    --role storage.viewer \
    --subject serviceAccount:<service_account_ID>

done (1s)

Create a trailCreate a trail

Create a connection between the trail and YQCreate a connection between the trail and YQ

You need to create a connection only when connecting the trail to YQ for the first time.

Run a query to logs in Object StorageRun a query to logs in Object Storage

Open the page to create an analytical query to Audit Trails logs:

Run event queries for the audit-trails-logsyq-object_storage binding:

1. Deleting a folder:

   1. Select this query from the list: 1. Find out who deleted the folder.

   2. Edit the query by specifying the folder ID:

      SELECT * FROM bindings.`audit-trails-logsyq-object_storage`
      WHERE
          JSON_VALUE(data, "$.event_type") = 'yandex.cloud.audit.resourcemanager.DeleteFolder' 
          and JSON_VALUE(data, "$.details.folder_name") = '<folder_ID>' 
          LIMIT 100;
      

   3. Click Execute.

2. Enabling access via the serial console:

   1. Select this query from the list: 6. Changing a VM: Adding serial console access.

   2. Edit the query by specifying the number of displayed records:

      SELECT * FROM bindings.`<audit-trails-logsyq-object_storage>`
      WHERE
          JSON_VALUE(data, "$.event_type") = 'yandex.cloud.audit.compute.UpdateInstance' 
          and JSON_VALUE(data, "$.details.metadata_serial_port_enable") = '1' 
          LIMIT <number_of_records>;
      

   3. Click Execute.

3. Changing access permissions for an Object Storage bucket:

   1. Select this query from the list: 11. Suspicious activity with the Audit Trails log repository (Object Storage bucket).

   2. Edit the query by specifying the number of displayed records:

      SELECT * FROM bindings.`audit-trails-logsyq-object_storage`
      WHERE
          (JSON_VALUE(data, "$.event_type") = 'yandex.cloud.audit.storage.BucketAclUpdate' 
          or JSON_VALUE(data, "$.event_type") = 'yandex.cloud.audit.storage.BucketPolicyUpdate') 
          LIMIT <number_of_records>;
      

   3. Click Execute.

4. Assigning admin permissions:

   1. Select this query from the list: 20. Assigning admin permissions (for a folder and cloud).

   2. Edit the query by specifying the number of displayed records:

      SELECT * FROM bindings.`audit-trails-logsyq-object_storage`
      WHERE
          JSON_VALUE(data, "$.details.access_binding_deltas.access_binding.role_id") = 'admin' 
          LIMIT <number_of_records>;
      

   3. Click Execute.

How to delete the resources you createdHow to delete the resources you created

If you created a separate bucket to complete this tutorial, you can delete it to stop paying a bucket use fee.