General information about the Audit Logs service
Access to audit logs is available to the Account Owner and a control panel user with a permission that includes the member role in the Account scope or the role audit_logs.admin.
Audit logs is a service for collecting and storing logs of events that occur in an account. Events reflect operations with resources or users:
- authentication and starting or ending a session in the Control Panel;
- reading specific data (accessing the secrets service, reading encryption keys, etc.);
- managing access rights and security services (users, roles, passwords, tokens, access keys, secrets, certificates, etc.);
- mutating operations with resources (creating, modifying, deleting servers, networks, volumes, etc.).
Audit logs include successful and failed events, as well as events not permitted by security policies. Once an event occurs, it is added to the audit logs and becomes available within a few minutes.
Audit logs are collected automatically and stored for 90 days. At any time, you can export them manually, set up automatic export to an S3 bucket or set up export via API.
Tasks solved
The Audit Logs service can be used for:
- passing audits, certifications, and compliance procedures;
- monitoring access to sensitive information;
- filtering logs for transmission to analysis systems;
- tracking suspicious behavior;
- analyzing the actions of a specific user or service and detecting anomalies;
- investigating information security incidents.
Pricing
The service is provided free of charge.