Yandex Audit Trails overview

Yandex Audit Trails lets you collect audit logs of Yandex Cloud resources and upload them to a Object Storage bucket or Cloud Logging log group:

• Uploading audit logs to a bucket.
• Uploading audit logs to Cloud Logging.
• Uploading audit logs to a data stream.

Collecting audit logs lets you use analytical tools and rapidly respond to events that occur to Yandex Cloud services:

• Searching audit logs in a bucket.
• Searching audit logs in a log group.
• Exporting audit logs to SIEM systems.
• Alert settings in Yandex Monitoring.

Yandex Cloud services whose audit logs are collected by Audit Trails:

• Yandex Audit Trails
• Yandex Certificate Manager
• Yandex Cloud Logging
• Yandex Compute Cloud
• Yandex Identity and Access Management
• Yandex Key Management Service
• Yandex Lockbox
• Yandex Managed Service for ClickHouse
• Yandex Managed Service for GitLab
• Yandex Managed Service for MongoDB
• Yandex Managed Service for MySQL
• Yandex Managed Service for PostgreSQL
• Yandex Managed Service for Redis
• Yandex Network Load Balancer
• Yandex Object Storage
• Yandex Cloud Organization
• Yandex Resource Manager
• Yandex Virtual Private Cloud
• Yandex Managed Service for YDB

The following events are logged:

• Logins by federated users.
• Creating/deleting service accounts.
• Creating/deleting keys of service accounts.
• Editing user roles and service accounts.
• Creating/deleting resources.
• Editing resource settings.
• Stopping/restarting a resource.
• Changing access policies.
• Creating/editing security groups.
• Actions with encryption keys and secrets.

Current service limits

The audit log doesn't capture authentication errors. For example, if a user makes an API call without an IAM token, this information will not be included in the audit logs.

The log captures authorization errors. For example, if a user attempts to create a resource without sufficient privileges, the log will include an error message.

The service also has quotas and limits.