Key OBS Operations Logged by CTS

Cloud Trace Service (CTS) is a dedicated log audit service within Huawei Cloud security. It keeps track of operations performed on cloud service resources, covering the user identity, IP address, operation details, and returned response information. These operation records let you do security audit, trace issues, and locate resources quickly. They also help you plan and use resources, and identify high-risk or non-compliant operations.

Related Concepts

What Is a Trace?

A trace is an operation log for a cloud service resource, tracked and stored by CTS. Traces record operations such as adding, modifying, or deleting cloud service resources. You can view traces to identify when operations were performed by which users for tracking.

What Is a Management Tracker and Data Tracker?

A management tracker identifies and associates with all your cloud services to record all user operations. It records management traces, which are operations performed by users on cloud service resources, such as their creation, modification, and deletion.
In OBS, operations on buckets (such as creating or deleting a bucket) are management traces and need to be recorded by a management tracker.
A data tracker records details of user operations on data in OBS buckets. It records data traces reported by OBS, detailing user operations on objects in OBS buckets, including uploads and downloads.

By default, CTS uses only the management tracker named System, which is automatically created by the system, to record management traces. It does not record data traces. To enable CTS to record data traces, you need to create a data tracker.

Working Principles of Auditing OBS Operations

With CTS, you can record operations related to OBS for future query, audit, and backtrack. Figure 1 shows how OBS works with CTS.

Figure 1 Collaboration among OBS, CTS, and LTS

When you perform operations on buckets (such as creating or deleting a bucket), OBS reports management traces to CTS. When you perform operations on objects (such as uploading or deleting an object), OBS reports data traces to CTS.
OBS traces can be stored in CTS for a maximum of seven days. To store traces for more than seven days, you can configure trace transfer to OBS or Log Tank Service (LTS). CTS periodically saves operation records to a user-defined OBS bucket or LTS log stream for long-term storage.

Configuring trace transfer to OBS or LTS will incur storage fees. For details, see Billing.
(Optional) You can use LTS to search for and analyze traces.

Billing

If you do not configure trace transfer to OBS buckets or LTS, the billing involves only CTS. The core functions of CTS are free of charge, covering the entire process of enabling CTS and its basic trace management. You can use the following functions for free:
- Enabling trackers at no additional cost
- Real-time and accurate tracking of cloud resource operations
- Free storage and search of audit traces for seven days, meeting short-term trace query and compliance check needs
If you configure trace transfer to OBS, you will be billed for storing trace files in OBS buckets. For details, see OBS billing.
If you need to use Data Encryption Workshop (DEW) to encrypt trace files stored in buckets, you will also be billed by DEW. For details, see DEW billing.
If you configure trace transfer to LTS, you will be billed for the log storage of LTS. For details, see LTS billing.

Important Notes

OBS Operations That Can Be Recorded by CTS

OBS operations that can be recorded by CTS are classified into management traces and data traces.

After you log in to the CTS console and enable CTS, the system automatically creates a management tracker named System. A management tracker identifies and associates with all your cloud services to record all your management operations.

In OBS, operations on buckets (such as creating or deleting a bucket) are management traces and need to be recorded by a management tracker.

Table 1 lists the OBS management operations that can be logged by CTS.

**Table 1** OBS management operations logged by CTS
Tracker Type	Operation Name	Resource Type	Trace Name
Management	Creating a bucket	Bucket	createBucket
Management	Deleting a bucket	Bucket	deleteBucket
Management	Listing buckets	Bucket	listAllMyBuckets (If you use OBS Console to list buckets, relevant traces will be recorded in CN-Hong Kong or AP-Singapore. For Latin America, traces of listing buckets are recorded as follows: those in LA-Santiago are recorded in LA-Santiago, those in LA-Sao Paulo1, LA-Buenos Aires1, and LA-Lima1 are recorded in LA-Sao Paulo1, and those in LA-Mexico City1 and LA-Mexico City2 are recorded in LA-Mexico City2.)
Management	Obtaining bucket metadata	Bucket	headBucket
Management	Obtaining the bucket location	Bucket	getBucketLocation
Management	Listing objects in a bucket	Bucket	listObjects
Management	Listing initiated multipart uploads in a bucket	Bucket	listMultipartUploads
Management	Obtaining the storage usage of a bucket	Bucket	getBucketStorageInfo
Management	Configuring the CORS rule for a bucket	Bucket	setBucketCors
Management	Obtaining the CORS configuration of a bucket	Bucket	getBucketCors
Management	Deleting the CORS configuration of a bucket	Bucket	deleteBucketCors
Management	Configuring a user-defined domain name for a bucket	Bucket	setBucketCustomdomain
Management	Obtaining the user-defined domain name of a bucket	Bucket	getBucketCustomdomain
Management	Deleting the user-defined domain name of a bucket	Bucket	deleteBucketCustomdomain
Management	Setting the lifecycle for a bucket	Bucket	setBucketLifecycle
Management	Obtaining the lifecycle configuration of a bucket	Bucket	getBucketLifecycle
Management	Deleting the lifecycle configuration of a bucket	Bucket	deleteBucketLifecycle
Management	Configuring cross-region replication for a bucket	Bucket	setBucketReplication
Management	Obtaining the cross-region replication configuration of a bucket	Bucket	getBucketReplication
Management	Deleting the cross-region replication configuration of a bucket	Bucket	deleteBucketReplication
Management	Setting a bucket tag	Bucket	setBucketTagging
Management	Obtaining bucket tags	Bucket	getBucketTagging
Management	Deleting the tag configuration of a bucket	Bucket	deleteBucketTagging
Management	Configuring static website hosting for a bucket	Bucket	setBucketWebsite
Management	Obtaining the static website hosting configuration of a bucket	Bucket	getBucketWebsite
Management	Deleting the static website hosting configuration of a bucket	Bucket	deleteBucketWebsite
Management	Configuring a bucket policy	Bucket	setBucketPolicy
Management	Deleting a bucket policy	Bucket	deleteBucketPolicy
Management	Configuring a bucket ACL	Bucket	setBucketAcl
Management	Obtaining bucket ACL information	Bucket	getBucketAcl
Management	Configuring logging for a bucket	Bucket	setBucketLogging
Management	Obtaining the logging configuration of a bucket	Bucket	getBucketLogging
Management	Configuring event notification for a bucket	Bucket	setBucketNotification
Management	Obtaining the event notification configuration of a bucket	Bucket	getBucketNotification
Management	Configuring a storage quota for a bucket	Bucket	setBucketQuota
Management	Obtaining the storage quota of a bucket	Bucket	getBucketQuota
Management	Configuring the storage class for a bucket	Bucket	setBucketStorageclass
Management	Obtaining the storage class of a bucket	Bucket	getBucketStorageclass
Management	Configuring versioning for a bucket	Bucket	setBucketVersioning
Management	Obtaining the versioning status of a bucket	Bucket	getBucketVersioning
Management	Configuring server-side encryption for a bucket	Bucket	setBucketEncryption
Management	Obtaining the server-side encryption configuration of a bucket	Bucket	getBucketEncryption
Management	Deleting the server-side encryption configuration of a bucket	Bucket	deleteBucketEncryption
Management	Obtaining the Block Public Access configuration of a bucket	Bucket	getBucketPublicAccessBlock
Management	Configuring Block Public Access for a bucket	Bucket	putBucketPublicAccessBlock
Management	Deleting the Block Public Access configuration of a bucket	Bucket	deleteBucketPublicAccessBlock
Management	Obtaining the public access status of a bucket policy	Bucket	getBucketPolicyPublicStatus
Management	Obtaining the public access status of a bucket	Bucket	getBucketPublicStatus
Management	Configuring an inventory for a bucket	Bucket	setBucketInventoryConfiguration
Management	Obtaining the inventory configuration of a bucket	Bucket	getBucketInventoryConfiguration
Management	Deleting the inventory configuration of a bucket	Bucket	deleteBucketInventoryConfiguration
Management	Configuring the Direct Reading policy for a bucket	Bucket	setBucketDirectColdAccess
Management	Obtaining the Direct Reading policy of a bucket	Bucket	getBucketDirectColdAccess
Management	Deleting the Direct Reading policy of a bucket	Bucket	deleteBucketDirectColdAccess
Management	Configuring back-to-source by mirroring rules	Bucket	setBucketBackToSource
Management	Obtaining back-to-source by mirroring rules	Bucket	getBucketBackToSource
Management	Deleting back-to-source by mirroring rules	Bucket	deleteBucketBackToSource
Management	Configuring a default WORM policy for a bucket	Bucket	setBucketObjectLockConfiguration
Management	Obtaining the default WORM policy of a bucket	Bucket	getBucketObjectLockConfiguration
Management	Sending an OPTIONS request to a bucket	Bucket	optionsBucket
Management	Configuring a bucket trigger	Bucket	putTriggerPolicy
Management	Deleting a bucket trigger	Bucket	deleteTriggerPolicy
Management	Creating a workflow template	Bucket	createWorkflowTemplate
Management	Deleting a workflow template	Bucket	deleteWorkflowTemplate
Management	Creating a workflow	Bucket	createWorkflow
Management	Deleting a workflow	Bucket	deleteWorkflow
Management	Updating a workflow	Bucket	updateWorkflow
Management	Creating a workflow directly	Bucket	directCreateWorkflow
Management	Enabling workflow authorization	Bucket	openWorkflowAuthorization
Management	Resuming a failed workflow instance	Bucket	restoreFailedWorkflowExecution
Management	Triggering a workflow using an API	Bucket	asyncAPIStartWorkflow
Management	Creating a public action template	Bucket	createMyActionTemplate
Management	Modifying a submitted public action template	Bucket	updateMyActionTemplate
Management	Deleting a submitted public action template	Bucket	deleteMyActionTemplate
Management	Disabling a submitted public action template	Bucket	forbidMyActionTemplate
Management	Agreeing to the service agreement	Bucket	openWorkflowAgreements

A data tracker records details of user operations on data in OBS buckets. It records data traces reported by OBS, detailing user operations on objects in OBS buckets, including uploads and downloads. You need to create a data tracker to record data traces.

Table 2 lists the OBS data operations that can be logged by CTS.

**Table 2** OBS data operations logged by CTS
Tracker Type	Operation Name	Resource Type	Trace Name
Data_Read	Downloading an object	Object	GET.OBJECT
Data_Read	Querying the object ACL	Object	GET.OBJECT.ACL
Data_Read	Obtaining an object through the website	Object	GET.OBJECT.WEBSITE
Data_Read	Accessing an object through the website	Object	HEAD.OBJECT.WEBSITE
Data_Read	Querying the object metadata	Object	HEAD.OBJECT
Data_Read	Listing part data	Object	LIST.OBJECT.UPLOAD
Data_Read	Querying the cross-domain requests for objects	Object	OPTIONS.OBJECT
Data_Write	Deleting an object	Object	DELETE.OBJECT
Data_Write	Canceling a part	Object	DELETE.UPLOAD
Data_Write	Uploading an object using a form	Object	POST.OBJECT
Data_Write	Batch deleting objects	Object	POST.OBJECT.MULTIDELETE
Data_Write	Restoring Archive objects	Object	POST.OBJECT.RESTORE
Data_Write	Completing the multipart upload	Object	POST.UPLOAD.COMPLETE
Data_Write	Initiating a multipart upload	Object	POST.UPLOAD.INIT
Data_Write	Uploading an object using PUT	Object	PUT.OBJECT
Data_Write	Configuring the object ACL	Object	PUT.OBJECT.ACL
Data_Write	Copying an object	Object	PUT.OBJECT.COPY
Data_Write	Configuring the object storage class	Object	PUT.OBJECT.STORAGECLASS
Data_Write	Uploading parts	Object	PUT.PART
Data_Write	Copying parts	Object	PUT.PART.COPY

Parent Topic: Using CTS to Audit OBS

Previous topic: Using CTS to Audit OBS

Next topic: Viewing OBS Traces