Configure automated audit log export to S3

For your information

Automated audit log export to S3 can be configured only by the Account Owner, a user with the member role in the Account access scope, or a user with a combination of the audit_logs.admin and s3.admin roles.

Automated export of audit logs to S3 allows you to automatically export specific events to an S3 bucket. Events for automated export can be filtered by project, service, or a specific event.

Export occurs in near real-time: an event is exported to the bucket a few minutes after it is added to the audit log service. Events are stored in the bucket until you delete them.

To export events, create an automated export. You can modify the automated export after creating it to select different events. To stop the automated export, delete it.

Create an automated export

1. In the control panel, on the top menu, click Products and select Audit Logs.

2. Go to the Automated export to S3 section.

3. Click Create automated export.

4. Change the name of the automated export or keep the default name.

5. Optional: enter a description for the automated export.

6. In the Event settings block, select the event parameters you want to include in the automated export:

   6.1. Optional: to export audit logs for specific projects, select the required projects. If no projects are selected, audit logs will be exported for all projects.

   6.2. Optional: to export audit logs for specific services, select the required services. If no services are selected, audit logs will be exported for all services.

   6.3. Optional: to export audit logs for specific events, select the required events. If no events are selected, audit logs will be exported for all events. If no events are selected but services are selected, audit logs will be exported for all events of the selected services.

7. In the Target S3 bucket block, select or create a bucket to which events will be exported. One bucket can be used for multiple automated exports. Once an automated export is created, the bucket cannot be changed.

   7.1. Select the region and pool for the bucket.

   7.2. Select a bucket or click Create new bucket. Buckets with the standard storage class and Virtual-Hosted addressing type are compatible with automated export.

   7.3. If on step 7.2. you clicked Create new bucket, enter its name. A bucket with this name will be created with the standard storage class and Virtual-Hosted addressing type.

   7.4. Optional: specify a prefix—a simulated folder where automated export data will be saved. If no prefix is specified, data will be saved in the root folder of the bucket.

8. Click Create. The automated export will start working once its status changes to ACTIVE.

Modify an automated export

1. In the control panel, on the top menu, click Products and select Audit Logs.
2. Go to the Automated export to S3 section.
3. In the menu of the automated export, select Edit.
4. Change the necessary parameters.
5. Click Save changes. Only events with the new parameters will start being written to the bucket.

Delete an automated export

Existing automated export data in the bucket will be preserved when the automated export is deleted. You can delete the data yourself by deleting objects or deleting the bucket.

1. In the control panel, on the top menu, click Products and select Audit Logs.
2. Go to the Automated export to S3 section.
3. In the menu of the automated export, select Delete.
4. Enter the name of the automated export to confirm deletion.
5. Click Delete.