turbot/alicloud

steampipe plugin install alicloudsteampipe plugin install alicloud

Table: alicloud_action_trail

Alibaba Cloud ActionTrail is a service that monitors and records the actions of your Alibaba Cloud account, including the access to and use of cloud products and services through the Alibaba Cloud console, API operations, and SDKs. ActionTrail records these actions as events. You can download these events from the ActionTrail console or configure ActionTrail to deliver these events to Log Service Logstores or Object Storage Service (OSS) buckets. Then, you can perform behavior analysis, security analysis, resource change tracking, and compliance auditing based on the events.

Examples

Basic info

select
name,
home_region,
event_rw,
status,
trail_region
from
alicloud_action_trail;

List enabled trails

select
name,
home_region,
event_rw,
status,
trail_region
from
alicloud_action_trail
where
status = 'Enable';

List multi-account trails

select
name,
home_region,
is_organization_trail,
status,
trail_region
from
alicloud_action_trail
where
is_organization_trail;

List shadow trails

select
name,
region,
home_region
from
alicloud_action_trail
where
trail_region = 'All'
and home_region <> region;

Query examples

Control examples

.inspect alicloud_action_trail

Alicloud Action Trail

NameTypeDescription
account_idtextThe Alicloud Account ID in which the resource is located.
akasjsonbArray of globally unique identifier strings (also known as) for the resource.
create_timetimestamp without time zoneThe time when the trail was created.
event_rwtextThe read/write type of the delivered events.
home_regiontextThe home region of the trail.
is_organization_trailbooleanIndicates whether the trail was created as a multi-account trail.
nametextThe name of the trail.
oss_bucket_nametextThe name of the OSS bucket to which events are delivered.
oss_key_prefixtextThe prefix of log files stored in the OSS bucket.
regiontextThe Alicloud region in which the resource is located.
role_nametextThe name of the Resource Access Management (RAM) role that ActionTrail is allowed to assume.
sls_project_arntextThe ARN of the Log Service project to which events are delivered.
sls_write_role_arntextThe ARN of the RAM role assumed by ActionTrail for delivering logs to the destination Log Service project.
start_logging_timetimestamp without time zoneThe most recent date and time when logging was enabled for the trail.
statustextThe status of the trail.
stop_logging_timetimestamp without time zoneThe most recent date and time when logging was disabled for the trail.
titletextTitle of the resource.
trail_regiontextThe regions to which the trail is applied.
update_timetimestamp without time zoneThe most recent time when the configuration of the trail was updated.