Uploading organization audit logs to Object Storage
Follow these instructions to create a new trail that will upload audit logs of all of an organization's resources to an Object Storage bucket.
Tip
For additional security of your audit logs, use bucket encryption.
Prepare the environment
To collect organization audit logs:
-
Create a new bucket with restricted access to upload audit logs to.
-
Create a service account.
-
Assign roles to the service account:
CLIIf you don't have the Nebius Israel command line interface yet, install and initialize it.
The folder specified in the CLI profile is used by default. You can specify a different folder using the
--folder-nameor--folder-idparameter.-
audit-trails.viewerfor the organization whose audit logs will be collected:yc organization-manager organization add-access-binding \ --role audit-trails.viewer \ --id <organization_ID> \ --service-account-id <service_account_ID>Where:
role: Role being assigned.id: ID of the organization from whose resources the audit logs will be collected.service-account-id: ID of your service account.
-
storage.uploaderfor the folder to host the trail:yc resource-manager folder add-access-binding \ --role storage.uploader \ --id <folder_ID> \ --service-account-id <service_account_ID>Where:
role: Role being assigned.id: ID of the folder to host the trail.service-account-id: ID of your service account.
-
-
On the Access bindings page, make sure you have the following roles:
iam.serviceAccounts.userfor the service account.audit-trails.editorfor the folder to host the trail.audit-trails.viewerfor the organization whose audit logs will be collected.storage.viewerfor the bucket or the folder.
Encrypting a bucket
To store logs in encrypted form:
-
Create an encryption key in Key Management Service.
-
Enable bucket encryption using the previously created key.
-
Assign the previously created service account the
kms.keys.encrypterDecrypterrole for the key:yc kms symmetric-key add-access-binding \ --role kms.keys.encrypterDecrypter \ --id <encryption_key_ID> \ --service-account-id <service_account_ID>Where:
role: The role assigned.id: The ID of the encryption key.service-account-id: The ID of your service account.
Create a trail
To create the first trail in Audit Trails and start the audit log management process:
-
In the management console, select the folder where you wish to host the trail.
-
Select Audit Trails.
-
Click Create trail and specify:
- Name: Name of the trail being created.
- Description: Description of the trail (optional).
-
Under Filter, set up the audit log scope:
- Resource: Select
Organization. - Organization: An automatically populated field containing the name of the current organization.
- Resource: Select
-
Under Destination, set up the destination object:
- Destination:
Object Storage. - Bucket: The name of the bucket where you want to upload audit logs.
- Object prefix: An optional parameter used in the full name of the audit log file.
Note
Use a prefix to store audit logs and third-party data in the same bucket. Do not use the same prefix for logs and other bucket objects because that may cause logs and third-party objects to overwrite each other.
- Destination:
-
Under Service account, select the service account that the trail will use to upload audit log files to the bucket.
-
Click Create.
What's next
- Learn more about the audit log format.
- Find out about the procedure for uploading audit logs to SIEM.
- Learn more about searching audit logs in buckets.