Configure automated audit log export to S3

For your information

The following users can set up auto-export of audit logs to S3:

• Account Owner;
• control panel user with a permission where the member role is selected in the Account scope;
• or a control panel user with a combination of the audit_logs.admin and s3.admin roles.

Auto-export of audit logs to S3 allows you to automatically export specific events to an S3 bucket. Events for auto-export can be filtered by project, service, or specific event.

Export occurs in near real-time mode — an event is exported to the bucket a few minutes after it enters the audit log service. Events are stored in the bucket until you delete them.

To export events, create an auto-export. You can edit the auto-export after creation — select other events. To stop auto-export, delete it.

Create auto-export

1. In the control panel, in the top menu, click Products and select Audit logs.

2. Go to the Auto-export to S3 section.

3. Click Create auto-export.

4. Change the auto-export name or leave the default name.

5. Optional: enter a description for the auto-export.

6. In the Event settings block, select the parameters of events that should be included in the auto-export:

   6.1. Optional: to export audit logs for specific projects, select the desired projects. If no projects are selected, audit logs will be exported for all projects.

   6.2. Optional: to export audit logs for specific services, select the desired services. If no services are selected, audit logs will be exported for all services.

   6.3. Optional: to export audit logs for specific events, select the desired events. If no events are selected, audit logs will be exported for all events. If no events are selected but services are selected, audit logs will be exported for all events of the selected services.

7. In the Target S3 bucket block, select or create the bucket where events will be exported. One bucket can be used for multiple auto-exports. After the auto-export is created, the bucket cannot be changed.

   7.1. Select the bucket region and pool.

   7.2. Select a bucket or click Create new bucket. Auto-export supports buckets with the standard storage class and addressing type Virtual-Hosted.

   7.3. If you clicked Create new bucket in step 7.2, enter its name. A bucket will be created with this name, standard storage class, and addressing type Virtual-Hosted.

   7.4. Optional: specify a prefix — a simulated folder where auto-export data will be saved. If no prefix is specified, data will be saved in the root folder of the bucket.

8. Click Create. Auto-export will start working when its status changes to ACTIVE.

Edit auto-export

1. In the control panel, in the top menu, click Products and select Audit logs.
2. Go to the Auto-export to S3 section.
3. In the menu of the auto-export, select Edit.
4. Change the desired parameters.
5. Click Save changes. Only events with the new parameters will start being written to the bucket.

Delete auto-export

Existing auto-export data in the bucket will be preserved when deleting the auto-export. You can delete the data manually: delete objects or delete the bucket.

1. In the control panel, in the top menu, click Products and select Audit logs.
2. Go to the Auto-export to S3 section.
3. In the menu of the auto-export, select Delete.
4. Enter the auto-export name to confirm deletion.
5. Click Delete.