Configuring responses in Yandex Cloud Logging and Cloud Functions

You can configure Cloud Functions to automatically respond to audit log events, e.g., to send messages through notification channels you prefer or automatically modify Yandex Cloud resource settings.

How it worksHow it works

In general, you will need the following components to configure responses via Cloud Functions:

1. Trail that uploads audit logs to a log group.
2. Log group that acts as an interface between the trail and a Cloud Functions trigger.
3. Yandex Cloud Logging trigger that invokes a function when adding a record to a log group.
4. Cloud Functions function that implements the response logic.
5. Optional auxiliary component, such as a Telegram bot or mail server.

Implementation exampleImplementation example

Yc-security-solutions-library contains a solution example that uses Cloud Functions to notify of specific events via a Telegram bot and modify Yandex Cloud resources in line with changes using API methods.

You can get notifications of the following events:

• Security groups: Allowing incoming traffic to all private addresses (0.0.0.0/0).
• Object Storage: Enabling public access to buckets.
• Yandex Lockbox: Assigning permissions to a secret.

The following actions may be performed on Yandex Cloud resources:

• Security groups: Deleting the rule.
• Yandex Lockbox: Removing assigned permissions to the secret.

This solution contains the source codes of a Python function and a Terraform script that configures all the required Yandex Cloud components.

What's nextWhat's next

• Learn more about the audit log format.
• Learn about existing solutions to export audit logs to SIEM.